WrongDeckLandings

ResearchandInvestigationReport

CommissionedbyCHCHelicopter

FinalReport

December11th2015

SteveJarvis

PhDMScBEd(hons)FRAeSMIEHFCErgHF

JarvisBagshawLtd

2

Contents

Part1–Overviewandsummary.. . . . . . 41.1Introduction . . . . . . . . 51.2OverviewofGeneralfindings . . . . . . 51.3WDLhigh-levelanalysis. . . . . . . 7Part2-CausalfactorsinWDLs . . . . . . 102.1Type1&3Errors-Transitionfromnavinstrumentstovisual . 11

2.1.2TheVisualTransitionZone(VTZ) . . . . 122.1.3Generalcatalyststotriggeringerrors . . . 14

2.1.3.1DecoyPlatformConcept . . . . 142.1.3.2.ResourceUseandLimitation . . . 162.1.3.3.Familiarity . . . . . . 172.1.3.4.Multipleidentifiers . . . . . 17

2.1.4Specificcatalysts . . . . . . 18

2.1.4.1SteepVTZ . . . . . . 182.1.4.2Earlytargetselection. . . . . 192.1.4.3Groupfactors(socialinfluence) . . . 202.1.4.4StrengthofDecoyPairingCharacteristics(DPCs) . 212.1.4.5Lossofvisualincircuitandfinalturn . . 212.1.4.6Weather . . . . . . 22

2.1.4.6.1Visibility . . . . . 222.1.4.6.2WindDirection . . . . 22

2.1.5Acceptingandlockingthetriggeringerror . . . 23

2.1.5.1Lackofscrutinyafterinitialtargetselection . 232.1.5.2Confirmatorythinking . . . . 232.1.5.3Useoflimited(orsingle)cues . . . 23

2.1.6.Errortrappingissues. . . . . . 24

2.1.6.1Signageandplatformidentification. . . 24 2.1.6.2PF/PNFactivityonlatefinals . . . 27 2.1.6.3Non-useofradar . . . . . 272.2Type2errors.FMS/NAVguidesacrewtothewrongplatform . 28

3

Part3–Indepthanalysisofproblem . . . . . 313.1Expandedfaulttreeanalysis-acquisitionofwrongtarget . . 32

3.1.1Overviewofwrongtargetacquisition . . . . 323.1.2Wronglyperceivedorrecalledroute/platform . . 333.1.3IncorrectVisualTransition . . . . . 33

3.2ExpandeddiscussionoffactorscausingvisualacquisitionWDL . 35

3.2.1.Correcttargetnotselected(FigureXXX4below) . . 373.2.2.Wrongtarget/Decoyselected . . . . 393.2.3.Wrongplatform/Decoyaccepted . . . . 413.2.4.SOP/formalerrortrapsfail . . . . . 423.2.5.Ambiguitiesnotnoticedorrejected . . . . 423.2.6FullFaultTreeforvisualacquisition . . . . 433.2.7Commonmodeissues(sub-faulttreesA,BandC) . . 43

3.3CrewfollowedFMStoincorrectplatform(routingtothewronghelideck) 45Part4-DataAnalysisSection . . . . . . 474.1DataCollected . . . . . . . . 484.2OnlineSurvey . . . . . . . . 49

4.2.1Topic1response(PerceivedreasonsforWDLs) . . 504.2.2Topic2(Perceivedsystemvulnerabilities) . . . 524.2.3Topic3(PerceivedTrainingVulnerabilities) . . 544.2.4Topic4(ActualEventsforanalysis(WDLsornear-WDLs). 564.2.5Analysisofattitudetowardwrongdecklandings . . 614.2.6Mainconclusionsfromsurveyfindings . . . 63

4.3PilotInterviews . . . . . . . . 644.4Incidentreportanalysis . . . . . . . 664.5In-flightobservations . . . . . . . 68Part5–Recommendations . . . . . . 715.1Ratingsforrecommendationsofthisreport . . . . 725.2Recommendationsforavoidingthetriggeringerror . . . 725.3Recommendationsfornoticingandtrappingtheerror . . 775.4Recommendationsforsignage . . . . . . 82Part6–Commentsonpreviousrecommendations . . . 846.1CHCWDLworkinggroup . . . . . . 856.2IOGPWOHLdocument . . . . . . . 87Appendices . . . . . . . . . 93

4

PART1–OVERVIEWANDSUMMARY

5

1.1IntroductionThisreportpresentstheresultsandanalysisofaprogrammeofworkcarriedoutbetween May and November 2015. Work involved 26 hours of in flightobservations,ninehoursofsimulatorwork,20pilotinterviews,anonlinesurvey(117responses),andananalysisof incidents. Indepthanalysiswasperformedincludingtaskanalysesandtaskorientatedfaulttreeanalysis.Awrongdecklanding(WDL)eventwasdefinedasanaircrafttouchingdownona platform or vessel other than the one that was planned. However a closeapproach to the wrong deck may also be problematic and since the entireprocesswasanalysedthe‘wrongdeckapproach’canbeincludedasasub-setofthe wrong deck landing. The only difference from an analytical perspective isthatthewrongdecklandingincudesafailedlateerrortrap(suchasreadingthedeckID)whereasthewrongdeckapproachdoesnot.1.2OverviewofGeneralFindingsMost wrong deck landings occur despite the FMS route being correct. A fewhappen as a direct result of it being incorrect. These two types of WDL arereferredtoastype1andtype2WDLsrespectivelyinthisreport.Thethirdtype(Type-3) are very similar to type 1 but involve an FMS route that is not fullyspecified(e.g.toapointnearavessel).Most Type 1 and 3WDLs (the vastmajority of allWDLs) happen because thetransference fromFMSnavigationtovisualnavigationgoeswrong.Thearea inwhich crews transfer from FMS navigation to visual navigation is named thevisualtransitionzone(VTZ)inthisreport,andattractsthedeepestanalysis.Itiswithin this area thatmost gain canbemade in resolvingWDLs, and thereforemostrecommendationsrelatetofactorsaffectingit.Theprocessthatgenerateswrong deck landings by these visual identification errors usually involves atriggering error (wrong selection of a visual target), acceptance of that target,and then failure to trap or notice that it is the wrong target. This process isreflectedinthefaulttreeanalysis.Inmostcases, insteadofselectingtheintendedplatform/vesselthecrewselectand accept a ‘decoy’ platform/ vessel. Thatdecoyusuallyhas someparticularcharacteristics which pair it to the intended target (called decoy pairingcharacteristics) such as similar name, similar looking structure, same colour,type, location, alignment, etc. Sometimes just one of these can be enough tocreate a WDL because pilots look for one firm cue as confirmation.Understanding of the decoy concept is important in resolving WDLs. In mostactual cases of WDLs the decoy was reasonably apparent and accessible inforesight,butwasnotnoticedor seenasa threatuntil after theevent.Factorsthatcausetheselection(andacceptance)ofawrongtargetcanbeassimpleasthe wrong platform coming into view before the right one, chance platformalignment,orthecorrectplatformbeingobscuredbycloudorshadowwhenthe

6

crewlookuptosearch.Thefirstsightingofaplatformwilloftenget‘locked-in’immediately whether right or wrong because of social direction andconfirmation(e.g.“visual,inlinewiththeredship”,“…confirmed”).Thishasthedualeffectofcrewsselectingtheplatformthatthefirstonedeterminestobetheintendedtarget(meaningthemostvisualtargetstandsmorechanceofselection,oftenfavouringadecoy)ANDleavingbothpilotsfeelingmoreconfidentintheirselectionthanisjustifiedbytheprocessofselectionthatwasused.Aftervisuallyselectingawrongplatform,acrewmusttrapornoticetheerrorinordertopreventaWDL.Butthereareanumberoffactorsthatimpingeonthis.Onceavisual sightingofaplatformorvesselhasbeenaccepted, thechanceofthe crew changing their mind in the face of contrary evidence (trapping theerror) gradually decreases (relatively) because of confirmatory thinking andcommunication by the crew (this has been observed). In other words, theybecome increasing less likely to question the process the more they agree orconfirmthatitisthecorrecttarget,andthismeansthattheywillbelesslikelytobe passively alerted to a wrong deck selection. Other factors overcome self-doubt,suchasgroupprocessesbetweenthepilots.Forthesereasons,andothers,earlyselection(e.g.ingoodVMC)isproblematicbecauseidentificationcuesareinsufficientatlongdistance,andyetcrewswillmaketheselectionearly,meaningthatbythetimethevisualcuesbecomesufficientlyclear,thecrew’smind-sethashadtimetostrengthensuchthattheymaycontinuetothewrongplatforminthefaceofseeminglyobviousdiscrepancies.Intermsoferrortraps,cross-checkingwiththeFMSneedstobemoreformalisedandconsistent,andthiswouldbesupportedbychangesintheFMSsoftwarethatdifferentiateroutewaypointsfromdestinations.Currently,themainproceduralerrortrapisforthepilotstovisuallyidentifytheplatformname(fromit’s IDplates)on late finals.This isseriously flawed.Signlocation is a particular factor here. Some signs are located far from the mainvisual reference that handling pilots use when approaching the helipad (thehelipaditself)andalsothesignlocationisoftenunpredictableforthepilot.Thiscauses flying pilots (PFs) to unconsciously prioritise between the visualreference used for aircraft control and the visual reference used for platformidentification (signage). Pilots will almost always prioritise aircraft control,whichmeansthatthetaskof identificationwillreceive littleattentionandmaybe droppedwithout the pilots being fully aware that they have done so. Thisshouldnotbediscouraged.If,withpresentsignagelocations,pilotsweretoldtopay more attention to the signs on late finals then a significant safety threatcouldbegeneratedthatwouldhavemorechanceofproducingaseriousaccidentthanthesubsequentWDLwouldhave.Recommendationsaremadethat,iftakenup,wouldhavetoinvolveBOTHsignagechangesandalatevisualerrortrap,butthelattermustnotbeimplementedwithouttheformer.The reportmakes numerous recommendations split into three areas: avoidingselection errors, effectively trapping those errors, and improving signage. The

7

recommendationsarerated1to4intermsoftheirpotentiallikelyeffectonWDLnumbers.Somewouldberelativelyeasytoimplementbuthaveonlyasmallortemporaryeffect.Somewouldundoubtedlyhavealargeeffect,butwouldinvolveeitherconsiderableworkandtesting,orexpense.1.3WDLHigh-LevelAnalysisIncident reports, interviews and survey data showed that most wrong decklandings were triggered by a single error (mistake, etc.) that was usuallyaggravated or promoted by catalysts within the situation. Self evidently theultimateerrorwasnottrapped.Thereforewrongdecklandingsneedatleasttwothings to happen: the triggering error AND no trapping given that error (asshowninthetoplevelofthefaulttreebelow,Fig1.1).

Figure1.1–thehighest-levelfaulttreesectionWithinmostoftheWDLsreviewedordiscussed,thaterroroccurredanywherebetween the flight planning stage (usually before flight) and the visualacquisitionofthehelipadduringlatefinalapproach. Thisareaisshownbytheblackhorizontalbracket line inFigure2,below.Withinanysinglesector thesecriticalerrorstendedtoclusterintotwoexclusiveareasofinterest,asshownbytheredovals.

Figure1.2.TherangethatWDLtriggeringerrorscanoccurwithinasector(black bracket). Red ovals show the two main clusters. Clearly with ashortersector(e.g.shuttle)therighthandovalinFigure1wouldbemuchwider(relatively)andthetwoerrorclusterswouldbeclosertogether,buttheyneverthelesswillremainexclusive.

8

ThetwoclustersoferrorsshownbytheredovalsinFig1.2canbedescribedasfollows:

1. Thetransitionfromnavigationalinstrumentstovisualacquisition.Thisisthe pilots’ transition from being guided by navigational aids (e.g. FMSroute) to acquiring a visual target onwhich to converge and set up theapproach. Hence the correct target is selected in the navigationalequipment,butthewrongtargetisselectedvisually.

2. RouteplanningandFMSprogramming;whereby thewrongplatformorcoordinates are used, for whatever reason. This means that the wrongplatform is selected in the navigational system, and accepted beforegettingairborneinmostcases.

ThetwomainerrorclustersarecausedbytheneardichotomybasedontheFMSroutebeingasintendedornot(i.e.FMSrightorFMSwrong).TheonlyvariationsarewheretheFMSdoesnotfullyspecifyadestination;e.g.ifroutingtoamovingvessel, if the crew are not using the FMS, or if the crew fly an intended butincorrectroutedespitetheFMSroutebeingright.Expandingtheanalysisusingfaulttreeanalysis(Figure1.3),thesetwotypesofWDL can be seen accompanied by a third type,which happenswhen the FMSroute is neither right norwrong, but is notwell specified. This usually occurswhenroutingtoamovingvessel.

Figure1.3–Topoffaulttree

9

Fromthemanyformsofdatacollectionandanalysiscarriedout,aswellastheactualincidentreports,itwasfoundthatthefirstofthethreeerrortypes(FMSroutecorrect)wasbyfarthemostcommon.Almost all of these cases involved an incorrect visual transition (meaning thatthewrongplatformwasidentifiedvisuallyandlandedon).Thisisdescribedfullyinthenextsection.TheotherformofType1erroriswheretheerrorhappenedas a result of the crew wrongly perceiving or recalling the route or intendedplatform (for example if they stop using the FMS because they remember thesequenceofplatformsandare familiarwith it).HenceInthesecases, theerrorcouldformanywhereinthetask(evenasagradualprocess),andisthereforeanexception to theerror clustering concept shownby the redovals in figure1.2.Hence these cases do not conform to the triggering error and error-trappinghypothesisbecausetheerrorispartofthecrew’splannedsequence.Thatmeansthatalthoughtheplatformthatthecrewvisuallyacquireisthewrongone, it isneverthelesstheonetheyintendedtovisuallyacquire,andyettheFMSrouteiscorrect. In these situations the error trapping is farmore difficult because thecrew’smentalmodelincludesthewrongplatformastherightone.Howeverdataandanalysisshowthatthesecasesareaverysmallminority,andthereforenoindepthanalysisispresentedinthisreport.Neverthelesstheywereconsidered throughout the data collection, analysis and when formingrecommendations.Finally,Type3WDLs(asshowninthefaulttree,Figure1.3)havesimilarcausesto type1WDLsbut theseareaggravateddue to theunderspecifiedFMS route(usually not an error itself). Hence, technically, type 3WDLs exist in the righthandredovalofFigure1.Forthisreason,type3errorsaretreatedthesamewayfromtheperspectiveoflaterextensionstothefaulttree.

10

PART2–CAUSALFACTORSINWDLs

11

2.1Type1and3errorsInmostoftheseerrors,aproblemintransitionfromnavigationalinstrumentstovisualacquisitionleadstothewrongplatformbeingselectedandlandeduponThissectiondetailstheproblemofthevisualtransitionanddetailswhereitgoeswrong andwhy.The visual transitionmeans themanner inwhichpilots swapfrombeingguidedbynavigationalsourcestobeingguidedbythevisualsightofthe platform. This process causes the vast majority of Wrong Deck Landings,which is why this section contains the greatest depth of analysis of theWDLproblem.

Figure2.1–Type1and3errorsonthefaulttree.

12

2.1.2TheVisualTransitionZone(VTZ)Theconceptofa‘visualtransitionzone’(VTZ)hasbeencreatedtohelpexamineand articulate the process by which pilots replace the FMS navigational cuesusedtolocatetheplatform,withthevisualcues(thesightoftheplatform)usedtosetuptheapproachand/or land.Thedotted line inFigureXbelowshowsatheoreticalVTZduringanormal(non-shuttlesector).

Fig 2.2 – The black dotted line is the theoretical visual transition zone(VTZ)foranormalsector(non-shuttle).The ideal transition from FMS to visual cues would probably consist of acomparison period, a reliable swapping of cues from FMS to visual (targetselection) after scrutiny is applied, and a number of subsequent cross-checks.Fromsimulatorobservationsusingtheeyetracker,andlineobservations,itwasobservedthattheVTZisverychangeable,butcanconsistofanincreaseinuseofvisual cues, accompanied by reduction in use of FMS cues, followed by fullchangeoveronfinalapproach.HoweverobservationsanddatashowedthattheVTZrarelymatchestheshallowstraightlineshowninFig2.2,andtheevidenceshowsthatothershapesexist,withrelatedvulnerabilities.Thesewillbeshowninsubsequentsections.AVTZoccursonallflightswheretheFMSisusedinitiallytofindtheplatform.Variousmethodswere used to build up an understanding of the process thatoccurs within the visual transition zone (VTZ). As well as active analysis(breaking down and unpacking tasks) methods included interviewing usingcognitive task analysis type probes, listening to crew conversations whileobserving flights, on line survey, and analysing eye tracker footage from twoexperiencedpilotsflyinganumberofsectorsinsimulators(EC225andAW139).From these it was clear that the VTZ can be split into at least two cognitivecomponents:

1. Platformselection2. Platformacceptance

Thesearereflectedintheextendedbranchesofthefaulttree,seePart3ofthisreport.Thetwopartsofthetaskmayoccuralmostcoincidentallyinsomecases,butareneverthelessseparateinthecognitivesense.

13

Theoretically the visual transition zone (VTZ) provides crewswith a period ofcoincident cues (both FMS and visual sight of the platform occurringsimultaneously)andthereforeopportunitytoreliablycross-referencethevisualtarget with the FMS generated waypoints. However whereas both cues aretheoretically available, in reality the FMS cue retains maximum specificationthroughout for the period, whereas the visual cue starts off under-specified(unless itappears late in thesector)andbecomes increasinglyspecifiedas thehelicopterapproachestheplatform.

14

2.1.3GeneralcatalyststotriggeringerrorsThe data analysis and discussion has identified numerous issues that can beworkedwith(termedspecificandgeneralcatalysts)thatcanleadtowrongdecklandingincidents.Thisisnotafulllist,becausemanyoftheissuesidentifiedonthefaulttreehavebeendeemedimpracticalorimpossibleintermsofplayingaroleinasolution,andmustthereforebeassumedtocontinuetoimpactupontheissueasnormal(e.g.fatigue,lackofattentionandgeneralmisperception).2.1.3.1.DecoyPlatformConceptMostwrongdeck landingsonly feature thewrong installation/vessel; therightone plays no part. The wrong platform/vessel is therefore the key tounderstanding WDLs. In the vast majority of wrong deck landings, the pilotswereattractedtoadifferentplatform/vesselthatactedasadecoy,asopposedtothemsimplylosingtheintendedplatform/vesselandpickingupadifferentone,or not being able to find the intended target. The destination (decoy)characteristics are extremely important in creating a wrong deck-landingsituation.Thebenefitofthisisthatthesecharacteristicsshouldbeforeseeableinmostcasesandsothisconceptishelpfulfromaninterventionperspective.Theconcept(beingtermedthe‘decoy’platform)emergesstronglyfromanalysisofmultiplesourceswhereactualincidentsandclosecallswerefocussedon.Theconcept became apparent when coding anecdotes, incident reports andinterview transcripts relating to real events. It didnot featureat all in generalnarrativefromthesurveyregardingreasonswhypilotsthinkWDLshappen.In thedecoyconcept the intended target is ‘paired’withanotherplatform(thedecoy)andthisisusuallyfixedforaconsiderabletime(possiblypermanent).InaWDLincidentorclosecall,thisdecoy(usuallyclosetotheintendedplatform)attracts the crew’sacceptancebefore the intended target, oron rareoccasionsattractsthecrewawayfromthecorrecttarget.Thedecoyoftenholdsthecrew’sacceptanceuntillanding(creatingaWDL).Adecoyisthereforeakintoatwinoftheintendedplatform,althoughitdoesnothavetosharemanyfeatureswiththeintendedplatformtobecomeadecoyandcreateaWDL.Thedecoytargetconceptissubtlydifferenttotheconceptthatpilotscommentuponwherebymanydecksnearbyaresimilar.Insituationswhereanumberofdecksexist,crewscanfinditdifficulttoselectthecorrectonefromtheothers,ordistinguishonefromanother.Thisisnotalwaysthecaseinadecoysituation;thecrewmayonlyeverseethedecoy. Incasesofadecoythecrewarenotusuallyattemptingtodiscernordistinguishonerigfromanother/othersinthearea,butare simply trying to spot and confirm their target platform as they wouldnormally. Inmany cases theyarenot aware, orvaguelyawareof thepotentialthreat of a decoy.Only after landing on it do theybecome aware of the decoythreatinhindsight.Inadecoysituation,thecrewflynormallyandtrytolocate

15

thecorrectplatforminanormalway,buttheypickupthedecoyinerror,andfailtorealiseitisnottheirintendedtarget.The characteristics that the decoy and the intended target share must beconsidered as the strength of the decoy. Where the intended target platform(whetheraninstallationorvessel)ishighlypairedwithadecoythechanceofaWDLissubstantiallyincreased.Thesharedcharacteristicsarecalledthedecoy-pairing-characteristic(DPCs)andrelatetocharacteristicsofthedecoythatpairitwiththetarget,thatcanpotentiallyleadapilottoselectandacceptthedecoyinsteadofthetarget.CommonDPCsincludethefollowing:

• Similarposition• Similarlookinginfrastructure• Similarname• Similarsize• Similarcolour• Similartypeofinstallationorvessel• Closetothetargetplatform(althoughthisisnotstraightforward)• SameNDBfrequency• Similarbearingfromthehelicopter• Inlinewiththeapproachtrack

Environmentalconditionssuchaswinddirectionandvisibilitycanstrengthenadecoy considerably by creating or strengthening its Decoy-Pairing-Characteristics (DPCs), such as making the approach paths align, or skewingcontrarycharacteristicssuchasdullingtheplatformcolour.Itappears that insomecasesonlyonestrongDPC isneededtocreateadecoy,butthemoretherearethestrongerthedecoywillbepairedwiththeintendedtarget.Howeverdueto thetendencytouse fewcues for identification,asingleDPCcancauseWDLbythepilotpickingupandacceptingthedecoybasedononepieceof information.Afterthis,confirmationbiastendstofocuscrewattentionon that one DPC to reassure the crews that the correct platform has beenacquired (see next section). This can lead to surprising eventswhereby crewslandonplatformsnamedverydifferently,orofadifferenttypetotheintendedtarget, or some considerable distance away. More than one DPC will clearlyincreasethechancesofthewrongplatformbeingselectedandaccepted.Notablyhowever, the decoymay have some characteristics that are dissimilar or evencontrastingfromtheintendedtarget,andmayhavenothingincommonwiththeintendedtargetexceptpositionalsimilarities(themselvesaDPC).Howeverthesecanalsogounnoticed.SinceDecoy-Pairing-Characteristics(DPCs)attractthepilottoselectandacceptthedecoyinsteadofthemainplatform,itisnotthatthepilothastroublelocatingtheintendedlandingsite(althoughthismayplayarole)butmorethatanotherlanding site is selected and accepted first (the decoy) and the error does notcome to light (is not trapped). The characteristic situation is that because the

16

pilotislookingforaparticulartargetinseeminglynormalcircumstances,alarmbellsdonotringwhenthedecoyisfoundfirst(comesintoview,appears,istheonly rig in sight, etc.). The error can also be promoted by factors such as theintendedtargetbeingobscuredornotvisible(shadowed,masked,hidden,etc.).DPCswill be extremely important considerations as a basis for any algorithmusedtogenerateWDLthreatlikelihood.Theobviouspartthatdecoyinstallations/vesselsplayinWDLscanbeillustratedbyconsideringthataWDLcannotoccurwherethereisonlyoneplatforminthearea.Henceconsideringonly the targetplatform in thesolutionwillalwaysbeinsufficient. Currently decoys are hardly considered in planning or threatconsideration(letaloneaspartofthesolution)andyetmostsectorsendwithaplatformorvesselthathasoneormoredecoysinthearea.Thepotentialdecoyplatforms to that target and the relationships between the platform and thedecoys should be accounted for when a realistic risk of WDL exists for anyreason(conditions,decoytypeandcloseness,etc.)Whereasaknownhighly-paireddecoy isaWDLthreat,anunknowndecoy isasubstantiallygreaterthreat.Thiswillnormallytaketheformofanothersimilarvessel.Whenplanningto landonvessels,asearchforpotentiallyhighlypaireddecoysshouldbeinitiatedattheplanningstage.Insomecasessimilarships(e.g.belonging to the same company) will be known. In other cases it is worthconsidering the use of electronic resources (such asMarineTraffic) that couldoffer informationas towhether similarvesselsare in thearea. If a crewknewthattwoverysimilarshipswereinanarea,precludingeasyvisualidentification,then they could manage the threat at the briefing stage and perhaps chooseapproachtypestominimiseWDLlikelihood.2.1.3.2.ResourceUseandLimitationThe fault tree (partA) illustrates how this factor affects the ability to find therighttargetandthepropensitytoacceptthattarget.Onmanyoccasionswhentheplatformisbeingselectedoraccepted,thereishightaskloadforoneorbothpilots(particularlyduringshuttling).Sometimesthisisanunanticipatedtaskoranewlyintroducedtaskthatmustbeaccomplishedinaddition to the normal task.Where these situations exist, the pilots aremorelikelytomakeselectionerrorsbecausetheirmonitoringoftheplatformwillbein the form of occasional short dwells outside, rather than longer repeateddwellsthatareusedtomaintaintheoverallpictureofplatformpositions.Theyarealsomorelikelytoacceptacolleague’splatformselection,andmayevendosowithacursoryglanceatthetarget.It is of note that platform selection and acceptance is often not denoted as aspecificresponsibilitywithinroleofPFandPNF.IfthePFisflyingmanually,thenthe opportunity for a visual acquisition error is relatively high, and so in such

17

casesthePNFshouldtaketheprimaryroleininsuringcorrectplatformIDwherephaseof flight allowsPNFvisual lineof sight to theplatform (e.g. prior to thefinal approach). However if the PNF has secondary tasks that demand visualresource, then both pilots may be vulnerable to mis-selection and acceptanceerrors, and may well not recognise the cross-cockpit vulnerability of theircolleague.Engrossed in taskingofonekindorother,bothpilotsmightassumethe other has performed normally and therefore not cross-check or applyscrutiny.The obvious issue here is the selected level of automation. The PF shouldmaintainahighlevelofautomationifthePNFisoccupied.2.1.3.3.FamiliarityThe familiarityofasituationcan leadcrewstoselectandaccept targetseasily,from theirprevious experience. Inmost cases this is bothuseful and accurate.Howeverwhere an unusual situation ariseswith a decoymore heavily pairedthanusual (e.g.due toconditionsorcircumstances), the familiaritycan lead tothecrewnotscrutinisingtheirchoiceafterpickingupthedecoy.2.1.3.4.MultipleidentifiersInthepresentsystem,itiswellknownthattherearemultipleidentifiersforthesame platform, and crewswill use a number of these (ICAO identifier,marineidentifier,FMSidentifier,etc.).ThismaybenecessaryinmanyrespectsbutitisaverylargegeneralcatalystthatdrivesmanyWDLsindirectly.Itisoneoftheonlycatalysts (specific or general) that has an impact on all dimensions of theproblem,includingallthreeerrortypes,andatalllevels(fromplatformselectiontoerrortrapping).ThepermutationsbywhichthishasthepotentialtoassistinthecauseofWDLsarenumerous.ClearlythetransposingofoneplatformIDintoanerroneousoneiseverpresent inallstagesof the flight.Howeverthe issuealsomakespassiveerror trapping (the noticing of inconsistency) much more unlikely in manycircumstances.

18

2.1.4Specificcatalysts2.1.4.1SteepVTZIn themajority of observed cases the visual identification of the platformwasaccepted as being correct (active scrutiny then closed or compromised) verysoonafter the firstvisual call, oftenwitha simple “check” from theotherpilotwith no subsequent observed scrutiny from the crew. This means that manycrews are closing the scrutiny process on visual targets very quickly afterselecting them, which equates to a very steep visual transition zone (VTZ) inmost cases, as shown below (Figure 2.3). Several additional factors aggravatethisaswilllaterbeshownlater.

Fig2.3Steepvisualtransitionzone.Thisshowsthevisualtransitionperiodas an initial action of selection and acceptance, where the transition iseffectivelycompleted.ThedeckIDprocedureisnotpartoftheVTZinthiscase,butisanerrortrappingaction.Thesteepvisualtransitionwasfurtherconfirmedfromsomeeyetrackerfootageshowing thatonce the target is locatedandquickly accepted, all furthervisualscrutiny is concerned with using the installation as a visual, not checking theidentification of it. Although not situationally realistic this does give furthercredencetothetheory.Interviewsalsotendedtobackthisup.AsizableminorityofflightobservationsnotedadifferentVTZprocess.Inthesecasestheprocessofscrutinywasleftopenafterfirstselection,oratleasttherewasnoobviousclosingoftheprocessimmediately.ThisgivesaVTZprofilethathasaninitialselectionfollowedbyalongerperiodofvisualtransitionasshownbelow(FigureLVT).Notably, the lengthof thisprocessdidnotshowasteadilydecreasingpattern,andmostpilotswhodidnotacceptthefirstsightingwaitedanoticeable amount of time before accepting inmost cases (sometimes tens ofseconds,sometimestensofminutes).Inmostcasestheprocessdidappeartobeclosed (target accepted) before the final error check on final descent. In otherwords, it appears that inmost cases the VTZ is steep (select and very quicklyaccept)butwhenitisnotthatshape,itcanbealmostanyotherlengthafterthe

19

initialselectionof thetarget.Theonerelativelycommonfactorwasthatcrewsappearedtoindicateacceptanceoftheplatformpriortothefinalerrorcheck.

Figure2.4–LessusualVisualTransitionZone,wherebytheinitialsightingis leftopentoscrutinyforarelatively longperiodbeforebeingclosedoffpriortothefinalerrorcheck.ThisgivesamuchlongerperiodofscrutinythanthesteepVTZinFigure2.3.2.1.4.2EarlytargetselectionThedifficultyofearlyvisualplatformacquisitionwasmatchedbythedatawithregards to vulnerabilities aroundmis-selection and incorrect acceptancewhenpilotsvisuallyselectandaccepttheplatformatlongdistance.Evidence showed thatonmost sectorspilots attempted tovisually acquire theplatformasearlyastheycould.Therewasnoobvioustrendastowhichpilot(PFor PNF) tended to acquire the platform first. Twenty-four observations wereloggedofinitialplatformvisualacquisitioninVMC.Theseobservationsshowedthattheaveragepointwherethefirstpilotsawtheplatform(basedonlisteningandwatchingthecrew)was6.1milesfromtheplatform.Fourweremadeover10milesout(thefurthestbeing27miles)butmanyweremademuchcloserin(eight were within 3 miles). Hence large deviation existed, mainly due to thedistanceofthesectorandtheweatherconditions.Thechancesofselectingthewrongplatformatlongrangesisrelativelyhighdueto:

• Lackoftargetdetail• Greaterdifficultyjudgingdistance• Greaterchanceoftheintendedtargetnotyetbeingvisible(farleftoffault

tree)• Greaterchanceofselectingadecoywhereoneexists(seenextsection).

It has been explained that an initial error of selecting or accepting thewrongplatformearlyon(ofteninasteepVTZ)cangounchallengedorgetlocked-inbyconfirmationbiasandminimalcueing,eveninthefaceof increasinglycontrarycues as thedistance closes.Hence the greater thedistance atwhich the crews

20

initiatetheVTZprocess,thegreatertheriskofpickingup,accepting,lockinginand landing on the wrong deck. Attempting to select the platform early isthereforeafactorintriggeringsomeWDLincidents.Theobservationsshowedthatthemeanpointatwhichcrewsdivergefromthelateralnavigational track inorder tomanoeuvreonto anapproach coursewas3.1miles(maximumobserved6miles,andminimum0.8).GiventhemeanVTZinitiation of 6.1miles (andmaximumobserved of 27miles), the conclusion ofinterestisthatcrewsareinitiatingtheVTZprocessunnecessarilyearly.Inotherwords, crewsare selectingandaccepting thevisual targetand thencontinuingontheGPStrackinanycaseforaconsiderabletime(usuallywiththeautopilotcoupled).Theywouldhavecontinuedinthatwaywhethertheyhadspottedtheplatformornot.So thesightinghadnoeffectuntil laterand thereforeanearlysightingisofnobenefitandmakesnodifference.This means it would have made no adverse difference had they selected thetargetalotlater,butindoingsowouldhavesubstantiallyincreasedtherelativechanceofcorrectlyselectingthetarget.ThisisimportantbecauseaftertheVTZorinitialselectionismade,crewsarelesslikelytoapplyscrutiny,morelikelytolock-in the early choice through confirmatory processes and ultimately morelikelytolandonthedecktheyselectfirst.Hencethefirstselectionofthevisualtargetshouldbemadeatapointwherethechancesofitbeingwrongarelowest(as late as possible) which is not currently happening. Currently crews aresimplyselectingthetargetasearlyastheycan.ThiseffectprobablyaccountsforthenumberofWDLsthatoccurongoodVMCdays,becauseonpoordaysthereislessopportunityforearlyselectionandthesubsequentlocking-ineffect.Itwasclear fromtheobservationsthatonmanyoccasionscrewswereactivelylookingtofindtheplatformatlongrange.Thisoftencoincidedwith‘downtime’in transit (when crews were under low workload with the autopilot in andawaiting the next step in the process, for example engaged in non-operationalconversationduringalongtransitleg).Thereappearedanaturaltemptationforpilotstofindtheplatformearlyinordertosteponthroughthetask.Thiscouldbepartlyduetoaneedtoidentifytheplatformwhiletheworkloadisstillverylow, before entering a higher workload phase (when visual acquisition andconfirmationmightbemorechallenging).Itcouldalsobethatatsuchastageinalongsector,findingtheplatformrepresentsthenextstepingettingthejobdone,andsocanfeellikeamoreimportantpartoftheprocessthanitactuallyis.2.1.4.3Groupfactors(socialinfluence)Observations confirmed that pilots usually steer each others’ attention to thefirstvisualacquisition,meaningthatwhenapilotnoticeswhattheybelievetobetheplatform,theyimmediatelydirecttheotherpilot’sattentiontothelocationofwhat they see (often pointing to it, or stating features to locate it such as

21

“directlyunder thatdarkcloud”. Inmostcases theotherpilotpromptlyagreeswith the first sighting of their colleague (usually within seconds and withseeminglyminimalscrutiny).Thiswillreliablyinsurethatifthedecoyplatformismore visible and so is erroneously selected, both pilotswillmake the sameerror.When this occurs, it is highly likely that the apparent agreement will act asfurther confirmation that the correct targethasbeen selected.Bothpilotsmaythen apply less scrutiny than theywould do if alone, or both pilots feelmoreconfident in their visual sightings due to the apparent agreement (or lack ofdisagreement)oftheother.Hence,drawing theattentionof anotherpilot to thevisual targetdegrades theindependenceofthecrewinlocatingtheplatform.Thesecondpilotverbalisingtheir agreement provides additional confirmation to the first pilot that thecorrect platform has been located. Elements of groupthink are immediatelyformed.Thisgroupthinkisusuallycorrect,becauseonmostoccasionstherightplatformisselected.Howeverifnot,ifnotitmakessubsequentrealisationoftheerror less likely because neither crew feel as much need to challenge theiracceptanceastheywouldwithoutsuchaneffect,oriftheywerealone.Such effects are well known, and observations showed indirect but strongevidenceofthese,andnoevidenceofthembeingdefendedagainst.2.1.4.4StrengthofDecoyPairingCharacteristics(DPCs)Whereadecoyplatformissimilartoand/orinapositionthatisnotunexpected(notevenanexpectedposition),thechanceofthisbeingselectedandacceptedinsteadof the intendedplatformisrelativelyhigh.Clearly themore factorsarepaired, and the stronger they are, the more chance the decoy has of beingselected. Proximity to expectedposition is also a factor, althoughnot a simplelinearone,sinceiftheintendedtargetisveryclosetothedecoyitislesslikelytobeoverlooked.2.1.4.5LossofvisualcontactincircuitandfinalturnObservationsfoundthatinalefthandfinalturn(particularly)withthePFontheright,visualcontactwiththeplatformislostforsignificantamountsoftime.Onseveraloccasionsitappearedthatthepilotsinitiatedtherolloutintwophases;firstly based on turn rate and/or timing, and secondly adjust the approachheadingtothevisualpicture.Thisleadstotheriskthatthecorrecttargetcouldhavebeenselected,butoncelostadecoygetsselectedduringoraftertheturn.

22

2.1.4.6Weather

2.1.4.6.1Visibility

There is no simple continuum or correlation betweenvisibility/conditions and WDL risk. This is because different weatherconditions promote different triggering factors in WDLs. Very goodvisibility is a risk due to early selection and lock-out. Moderately poorvisibility is a risk due to the target platforms being hidden and decoyplatforms being picked up first. Very poor visibility leads to an ARA,whichislessofarisk(althoughnotcompletelyriskfree).

2.1.4.6.2Winddirection

Increased risk is created where wind direction is matched to bearingbetweenintendedanddecoyplatforms.Whenthishappensasituationiscreatedwhereby a decoy platform is positioned on the same approachtrack as the intended platform. This creates a high risk of WDLsparticularlyinrelativelypoorvisibility.Oneofthemaincuestoselectingand accepting a platform is that it is seen in position ahead of thehelicopter. Pilots are used to identifying their target platform in the 12o’clockposition,andarethereforeusedtosearchingasmallarcaheadforthe target. Having a decoy in this position is a major risk, because thepilots can lock onto the decoy platform using only this expected thepositionastheirprimarycue,andrejectcontrarycuesasexplained.

23

2.1.5Acceptingandlockingthetriggeringerror2.1.5.1LackofscrutinyafterinitialtargetselectionNotablefromobservationswasthetendencyofcrewstodropactivescrutinyoftargets once they had been seen and accepted (often very quickly in a singleVTZ)2.1.5.2ConfirmatorythinkingWherecrewsdidcommentonplatformsaftertheVTZorinitialvisualselection,there was a tendency of crews to use conformational comments of platformidentification,asopposedtoactivescrutinyorquestioning.Thistypeofpseudo-questioningorcommentingcaneasilylockinawrongtargetaswellasarighttarget.ThisisworsewhentheVTZisquickandsteep,becausethen the visual target has been accepted as the correct installation and thescrutinyrelaxedimmediately.Thecommentscanbecharacterisedas“thisiswhyweareright”commentsasopposedto“thisiswhywecouldbewrong”comments.This is sometimes referred to as confirmation bias. In the former case, crewsattempt to fit expectations to data (what they see) and vice-versa. They caneasilymissunexpectedfeaturesbecausetheyarenotactivelylookingforthese.Theproblemwith suchquestioning is that it easily fails toaccount forwhat isseenbutisnotexpected,andwhatisexpectedbutnotseen.Ittendstoaccountmostlyforwhatisbothseenandexpected.2.1.5.3Useoflimited(orsingle)cuesNotable as a related issue,was the fact that commonly only one or two visualelementswere used (often repeatedly) tomake and confirm the identificationthroughouttheidentificationandacceptanceperiod,andallthewaytothefinalplatform identification before landing. Coupled with the confirmatorycommentingandquestioning,thisdemonstrateswhycrewscanlandonawrongdeckinthefaceofsomeseeminglyobviouscontraryevidence.

24

2.1.6Errortrappingissues2.1.6.1.SignageandplatformidentificationPlatformsignageplaysnopartinthevisualselectionofplatformsbutintermsoferrortrappingitistheprimaryelement,becauseitrepresentstheonlydefiniteconfirmationoftheplatform.Thesignageneedstobereadablefromasgreaterdistance as possible, and fromall angles. Currently, there aremanyproblemswithidentificationsignage:

A. PositionofsignsB. MissingsignsC. Clarityofsigns&fontD. PlatformnamesE. ColourF. ExtraneousletteringonsignsG. Inconsistencyofidentifiers

A.PositionThe current position of platform signage is too far from the helipad andinconsistentEye tracking data supported by observations confirmed that the helideckgradually becomes the only major visual reference used by pilots as theyapproach it, and then is held by them until landing. Very few natural eyemovementsaremadebythePFawayfromthedeckoncethehelicopteriswithin0.5. miles (often reading distance) from the deck. Although pilots often lookaroundthedeckandnearobstacleswhileapproaching(e.g.atcranesetc)theeyeshifts are small, prepared, and usually within a few degrees of the deckreferences.For this reason any signage that requires the pilot to look more than a fewdegrees fromthedeck(orsearchfor it)causesthepilot to lookawayfromtheprimaryreferencesthatthepilotwantstobelookingat.Suchdistractionfromthehandlingtaskhasthepotential tobeaserioussafetyrisk.Howeveronthevastmajorityofoccasionspilotswillnotprioritiseasearchfor signage over flying control and so theywill unconsciously drop the searchandconfirmationprocesstoconcentrateontheflyingtaskreferences.Thesignmay not be fully read, and errors in verbalising the sign are more likely.Expectationbiascouldalsocausethepilottosaytheexpectedidentifierratherthan the real one they looked at because they have not devoted sufficientattentiontoit.Howeverthismeansthatnofinalerrortrapexistsinmanycasesbecause flying pilots do not have the spatial capacity to both search and flyaccurately. Signage should be easily discernable and in the same area as thevisualreferences thepilot isusingat thetime.Pilotswillbeable toconfirmor

25

readasign thatappearsclearly in thearea that theyarealready looking,evenundermoderateworkload.

Figure2.5.AnexampleofcurrentsignageThepictureabove (Figure2.5) showsacurrentplatformsignageexample.ThesignispositionedoutofsightofthePNFandwillcausethePFtoswitchattentionfromthehandlingofthehelicopter,forseveralreasons:

26

1. The distance between the primary reference used for controlling the

helicopteratthispoint(thehelideck)andthesign,istoogreat.2. Thelackofsalienceofthesign(itneedsattentionjusttofindit,beforeit

isread,becauseitcannotbeeasilylocatedbytheeye–itdoesstandoutin the peripheral vision, and the position cannot be learned (like thepositionofaninstrument)

3. Thesizeofthesign(itcannotbereaduntillatefinals)4. The extra letters around the name (“P15/C-PP” instead of “P15”). This

demands attention because the word cannot be deciphered in a singlebriefglance.

Theabovemeanthattheplatformidentificationprocesswilloftenbeflawed,andunlikely to traperrors,because thepilot cannotdevote theattention required,and in many cases will either not attempt it or will do it unconsciously andwithoutscrutiny.Ithasbeenshownthatevenhavingtocalculatecross-windfromanATCcall isenough to interfere with a manual flying skill task on approach, and that iswithoutanoff-taskvisualreferencerequiredtoobtaintheinformation.Thegreaterrisk inthissituationisenforcingasituationwherepilotsmustpaymoreattentiontothesignage(againsttheirnaturalinstinct).Iftheydothiswiththe current situation described, the manual control task could be impacted.Occasionallysuchanimpactwilltriggeranincidentorevenanaccident.B.MissingsignsAll the above applies equally tomissing signs, but these have the potential tocauseevengreaterdistractionasthePFattemptstolocatethembutisunableto..C.Clarityofsigns&fontThepresent systempresents the IDs as capital letter codes. Capital letters areknowntobemoredifficulttodiscernatadistanceduetotheshapecreatedbythem (the percept), which is a rectangle, whatever letters are used. Signs areoften faded or dirty. These unmaintained signs can be unclear and draw toomuchattentionfromtheflyingpilot.Thesafesteffectthatthiswillhave isthatthepilotwillprioritisetheflyingovertheplatformidentification.D.PlatformnamesThere are two issues here. Firstly decks in similar locations often have verysimilar(ornearidentical)names.Thismeansthedecoycanhaveasimilarnameto the intended target. Secondly, the names are not meaningful. However thelatterprobablybecomeslessofaproblemwithexperiencebecausecrewslearntheplatformnamesaswordsthatrelatetoplatformsinameaningfulway.

27

E.ColourColourofsignageisnotalwaysconsistent,andthismakesasignslightlyharderto locateeasily.Allsignsshouldbeconsistent inordertobeeasilyspottedandmentallyconfirmedasbeingthedeckIDwithoutthepilothavingtopayundueattentiontothisaspect.F.ExtraneousletteringonsignsThe ID that thepilotneeds is often containedwithinotherelementsof the ID.Thismeans that the IDmust be selected from a longer code. Undermoderatemanualworkload, thisadds to the likelihood thatpilotswill ignore the signorsimply state what they expect, because otherwise too much attention isdemanded,andpilotsrightlyprioritisetheflyingtask..G.InconsistencyofidentifiersPilots oftenhave to transpose oneplatform ID type for another. Themaritimeidentifier, FMS identifier and ICAO identifier can be different. This provideslargepotentialforerror,andalsoweakenstheerrortrapping.2.1.6.2.PF/PNFactivityonlatefinals.On late final approach, PFs fixate almost exclusively on the helipad, which isnecessary and should not be changed. However observations showed a widevariety of PNF actions during the final approach. Some PNFs were heads upthroughout the approach, some were heads down, some mixed. Whereas thechecklistscanrequirebothPFandPNFtoconfirmtheplatformname,oneofthemajordifficultiesthatPNFsfaceonfinalapproachisthatonmanyoccasionstheyarephysicallyunabletoidentifytheplatformbecausethesignageisnotvisibletothem. It is therefore of little use expecting or proceduralisingPNFs to confirmtheplatform ID, if theproblem is that they cannot see it. The fix is tomake itvisiblePNFandifthiscannotbedone,toimplementasystemwherebyPNFsdonotneedtoseeit.2.1.6.3.Non-useofradarObservations found that not all crews had their radar switched on for allapproaches. Radar offers an additional protection over the FMS; it highlightsdecoys that are not in the FMS or nav system, andmay have been picked up(suchasothershipsorplatformsnothighlightedontheNavdisplay).ThusitcanbeusedtorejectdecoyplatformswhenoverlaidwiththeFMS.Inseveralcasesofanecdotes,hadtheradarbeenon, itcouldhavebroughtthecrews’attentiontothefactthatthereweretwoplatformsintheareawhenthecrewthoughtittobeonlyone,andhadpickedupthedecoy.

28

2.2Type2errorsTheseerrorsoccurwheretheFMS/NAVguidesthecrewtothewrongplatform/awayfromtherightplatform.

Figure2.6Type2errorlocationinthehigh-levelfaulttreeDatacollectedshowthatthismodeofWDLmakesuponlyasmallminorityofthecases.Analysis show that there are anumberof possibleways that thewrongplatformispresentedtothecrewastheintendedplatformbeforereachingthevisualtransition,butthatnonearecommon,andtherearenostrongtrends.Thetwoexclusivemodesoferrorare:1. The Crew transpose the right information into the wrong information andenterthatintothenavigationalprocess.2.TheWronginformationisgiventoorpresentedtothecrew(includingwheretheFMSdatabaseisincorrectornotuptodate).Boththesemodescanoccureitherpriortothepilotsboardingtheaircraft,afterboardingpre-flight,anden-route.The data show that the most common problem is the crews being given thewrong information, however there is no general trend, and even this issue isinsufficientlyfrequenttoproducereliabletrends.Thereappeartobemanywaysthat thecrewscancome tobe ina situationwhereby theyareguided towardsthewrongplatformbeforevisualacquisition.Forexamplecrewcanbegiventhewrong platform as the route, thewrong / conflicting information or the right

29

platform name/route but the wrong information relating to it. In these casesthereislittlethecrewcandotoprotectagainstaWDL.Ifthecrewaregiventhewrongplatformaspartoftheflightplan,thenfromtheirperspectiveitisnotaWDL,sincetheyhavecarriedouttheplancorrectly.Onlyiftheyhavebeengiventheconflictinginformation(e.g.rightvesselbutwrongcoordinates)dotheyhaveachanceoftrappingit.HoweverwheretheFMSandthecrewintentionarebothset for the wrong destination (for whatever reason) the crew have a highprobabilityofcarryingoutthatrouteandlandingonthewrongdeck.The survey, along with incident analysis, shows that this problem is neitherperceivedbymanypilotsasbeingalargeissuecausingWDLs,nordiditfeaturein the actual related examples (anecdotes). For example the number ofcommentsgivenrelatingtothefollowingfourfactorsareasfollows: Imprecisenon-updatedpositionreportsfrommovingvessels 5SelectwrongpositionorcoordinatesinFMS 8SelectwrongriginFMS-similarname 1Crewsgivenwronginformation 1Thismeansthatonly15outof316commentsgivenbypilotsforperceivedWDLcausesrelatedtotheNAV/FMScontainingthewrongplatform/route.This was backed up by the reasons given for actual events (anecdotes) asfollows: Imprecisenon-updatedpositionreportsfrommovingvessels 2SelectwrongpositionorcoordinatesinFMS 0SelectwrongriginFMS-similarname 0Crewsgivenwronginformation 4Thismeans thatonly6of129reasons forWDLsevents (anecdotes) related totheissue.Intermsofactualincidentreports,fewerthan5%ofreportscouldberelatedtoan unintended platform in the navigational route. This number is probablylower, but depends how the analysis is performed, and involves some level ofconjecturewhereinformationisunclearwithinthereport.Theother issue thatcanoccur iswhere theFMS information iswrong/outofdate, and this can lead crews tonavigate towardsapointwhereaplatformorvesselisnotlocated.ThisdoesnotnecessarilygenerateaWDLbecauseinalmostall cases there isnodecoyplatform in thepositioneither.However the factorsthatcreatesproblemsinthevisualtransitionzone(type1and3errors)equallyapplyinthiscase,andsofortheseerrors,theanalysisandfaulttreesfortype1and3errorsisappropriate.

30

It is possible that between 4 and 8% ofWDLs are caused by these issues. Insurveys,pilotsperceivedthistobeagreaterissuethanastraightforwardwrongrouteorplatforminthesystem.Thefactor“Rigpositioninformationwrong(e.g.not up to date,moved”was eluded to by 11 pilots in the survey, and seen ascontributoryto3incidents(fromanecdotes).Nevertheless,thesefindingsrevealthatthisissueisminimalwhencomparedtotheincorrectvisualtransitionissue.

31

PART3-IN-DEPTHANALYSISOFTHEWDLPROBLEM

32

3.1Expandedfaulttreeanalysis-acquisitionofwrongtarget3.1.1OverviewofwrongtargetacquisitionPart2gaveanoverviewoftheanalysisatahighlevel,includingthetoplevelofthe fault tree analysis (shown below). From there the analysis becameprogressivelydeeper,unpacking thevarious independentanddependenterrormodesthatleadtowrongdecklandings,withmosteffortgiventothemainerrormodeofselectingthewrongvisualtarget.ThelightbluefilledboxesinFigure3.1belowrepresentthemainerrortypeforWDLs–thevisualtransitionissue.Themainextendedfaulttreeanalysislookedintothisissue,andhenceappliestotheextensionofeitherlight-bluebox.

Figure3.1-HighlevelfaulttreeThebottomof the fault tree inFigure3.1showsthatType1WDLs(FMSroutecorrect) are either related to selecting thewrong platformwhen transitioningfrom FMS to visual cues (thereby landing on the platform that they did notintendto)orbyflyingtoaplatformthatthecrewthinksistheFMSroute,butitisnot (thereby landingon theplatformthat they intended to,but thatwas thewrongone).Thesewillbediscussedinturn.Theformerisfilledinlightbluein

33

the diagram because it involves the visual transition error shared by Type-3WDLs,andtheseerrorswillbeanalysedindepth.3.1.2Wronglyperceivedorrecalledroute/platformTheredovalinthefigurebelowshowsthelocationofthiserrortypeonthefaulttree.

Figure3.2–Locationerrortype(Wronglyperceivedplatform)This is not a common error, but cases did appear in the data (survey andinterviews).Anexample iswhereacrewwasshuttlingbetween twoplatformsrepeatedly but with one change within that plan. They forgot this change (ormistookit)andflewtothe‘normal’platformintheroute.Inthesecasestheerrortrappingismuchmoredifficulttoachieve.TheseWDLsprovideastrongcaseforacrewtofollowtheFMSrouteevenwhentheyknowtheplatforms,andcanseethem.It isalso important forthecrewtorecheckthenextplatformintheplanbeforedeparting.Thisbranchhasnotbeenextendedduetothesmallnumberofcases,butwasconsideredintherecommendations.3.1.3IncorrectVisualTransitionTheredovalsinthefigurebelowshowthelocationsofthisonthefaulttree.

Figure3.3–Locationerrortype(incorrectvisualtransition)

34

Visual acquisition errors are caused within the VTZ (by definition) unless, ascould hypothetically occur, there is no VTZ because navigational cues run outbeforevisualcuesappear.FMSunderspecificationmakestheVTZexceptionallyvulnerabletoerror(causingtype3errors)andisthemostlikelycauseoftherebeingnoVTZbecausetheFMScuesendbeforethevisualcuesbegin.Thiswouldmean no period of redundant cues and therefore no opportunity for cross-checking.WDLscausedbyincorrectvisualtransition(whetherpartof‘FMScorrecttype1’or ‘FMS underspecified -Type 3’) occurwhen the crewnavigate to the correctplatformusingnavigationalsourcessuchastheFMS,untilavisualidentificationerroroccursatwhichpointtheydivergefromtheintendedtrackandlandonthewrongdeck.TheymayswitchstraightfromtheFMSroutetovisualacquisitionofthewrongdeck,ormaymakeacorrectswitchfromFMStovisual,butswaptothewrong deck before landing. Other theoretical possibilities existwithin thisset, such as the crewdiverging from the route and then using thewrong FMSwaypoint to select a visual target, or the crew mistaking a waypoint for adestination.In type 3 errors (route under-specified) there is a high chance of a transition‘vacuum’ where the FMS guidance has ended before any reliable visualidentification of the vessel or platform is possible. Such gaps are a breedinggroundforerrorscausingWDLs.

35

3.2Expandedfaulttreeanalysis–AcquisitionofwrongtargetThiselementofthefaulttreecanbeextendedfromeithertheleftorrighthandnode (box 1 or 3) of the very high level tree shown in Figure 3.1, but is notrelevanttothecentralnode(box2).Hence it is forusewhentheFMSpositionhasbeencorrectlyprogrammed,whetherornotitishighlyspecified.It was clear from the incident reports and online survey that by far themostcommon causes of a triggering error leading to a WDL (or ‘near-miss’) is theselection of the wrong platform despite the right platform being correctlyprepared for and correctly shown on the FMS/Navigation display. Hence, thisaspectwas analysed in considerable detailwith an expanded part of the faulttree that took account of all WDLs caused by visual acquisition of the wrongtarget(Figure3.4,below).NotethethreeANDgatesat thetoptwo levels.Thisshows that awrongdeck landing causedby the visual target error (by far themostcommoncause)andthisrequiresthreeoccurrencesinordertocreatethetriggeringerrorandtwofailedoccurrencestobreacherrortrapping.

36

Figure3.4-Firstpartofextendedfaulttreebranch(triggeranderrortrap)Ascanbeseen,atriggeringerrorismadeupofthefollowingthreefactors,allofwhicharerequiredtooccur.Theprocessofthesefactorsislinear(oneaftertheother, with the exception that they may occur almost coincidentally) andthereforetheprocessequatestotheperiodof theVTZ(visual transitionzone).Thethreefactorsare:

1. Correcttargetnotselected2. Wrongtarget/Decoyselected3. Wrongplatform/Decoyaccepted

If the error is to continue to the incident consequence (not get trappedat anypointduringoraftertheVTZ),thefollowingarenecessary:

37

4. SOP/formalerrortrapsfail5. Ambiguitiesnotnoticedorrejected

Because all these five factorsmust combine, theremight appear to be a goodopportunity for resolution.However the three triggering occurrences could alloccurasasingleevent.Thiswouldbeparticularlylikelyintheeventofastrongdecoybeingpresentbecauseifthedecoyisseenbeforetheintendedtargetandaccepted then the initialoccurrence (Correct targetnot selected) is fulfilledbydefault. If the decoy has a very strong Decoy-Pairing-Characteristic (DPC) ormore than one DPCs, then it might also be accepted very quickly, or eveninstantly, leaving the error trapping as the only defence against awrong decklanding.Thisisparticularlylikelywithamovingvessel,andwithpoorvisibility.Thefactorsareeachexpandeduponasfollows:3.2.1.CorrecttargetnotselectedAscanbeseeninthediagram(Figure3.5,below)therearealargenumberofORgates in this branch. This shows that there aremanyways in which that thisfailurecanoccur.Fromaninterventionperspective,thisisproblematicbecauseanyofthesecouldindependentlycreatethetopcondition,meaningeachwouldhavetobemitigatedfor.Thissituationisusuallybestresolvedbyusinganerrortrap at a high level (or above the level) to catch all the various possibilities,ratherthanattemptstorectifyeachpossibilityattheroot.Wheretheindividualfactors at lower levels can be easily mitigated for or defended against thenattemptingtoresolveattherootscanbeworthdoing,butthefaulttreeindicatesthat the underlying causes here are difficult to deal with in many cases, andimpossible in others. Also, some of the mitigations will form of overallmitigations across all parts of the analysis (e.g. correct target insufficientlyidentifiable’).FortunatelyinthiscasethebranchisoneofthreejoinedbyANDgates(asshownearlier) and so targeting one of the other two factors that conjoin it will beeffective against errors on this branch. Against this background and since thisfactorcanbebreachedaspartoffactor2(particularlywhendealingwithadecoyplatform) it is not considered beneficial to make interventions based on thisaspectoftheproblem.

38

Figure3.5–Causesofafailuretoselecttherighttarget.Theyellowbranchreferredtoas‘A’isshownbelowinFigure3.6.

39

Figure3.6 – this extends fromanumber of parts of the fault tree, and isconcernedwithlimitationsofthecognitiveresources.Figure 3.6 illustrates that automation levels have a part to play, and this iscontrollable. Since ‘A’ features in a number of branches of the fault tree, it isworthlookingatfromaninterventionperspective.3.2.2.Wrongtarget/DecoyselectedFigure 3.7 (below) shows five independent factors that can feed this error. Aswiththepreviousfactor,thereisnorealisticwaytopreventpilotsfrommanyofthese. For example a pilotmaywell see the decoy platform first due tomanyreasons includingweather, position andobstruction, noneofwhich arewithinthe control of the operators. However, like the previous factor, there is somescope for read-across between braches; for example the HLO communicationfeatures inboth.Whereasingle factor features inanumberofbranches, therecan be value in tackling it, particularly if it has the potential to be a commonerrormodethatcreatesfailureonbothbranchescoincidentally.

40

Figure3.7–Causesofmis-selection

41

3.2.3.Wrongplatform/Decoyaccepted

Figure3.8–Thefaulttreefor‘wrongplatform/decoy’acceptedThisbranchofthefaulttreeisperhapsthemostimportantintermsofWDLs.ItisrelatedtotheperiodoftimecalledtheVisualTransitionZone(VTZ).Figure3.8

42

showsthebranchesdescribing the issueofpilotsaccepting theselectedwrongtargetastheonetheyareintending.Inordertodothistheymusthavefailedtofindtherighttargetaswellashaveselectedthewrongtarget(startoftheVTZ).Onceselected,themighterroneouslyacceptitastherighttargetimmediatelyorover aperiodof time, and thatperiodof timeequates to the remainderof thevisualtransitionzone-VTZ).Giventheperiodoftimethisprocessusuallyoccursover,thereismoreroomforinterventionthanthefirsttwoprocesses.Notably, thehighest level of thisbranch contains four elementsunder anANDgate. This appears to be a safe situation. However there is a common branchtermed ‘B’whichextends from threeof the fourelements.This is thereforeanimportantareatolookatbecauseithasthepotentialtocauseafailureonthreeofthechannelsthroughasinglecommonmode.Thesub-faulttreeentitledB(withagreybackground)isthereforeperhapsthemostcriticalpartofthefaulttreeanalysisforWDLs.Additionally the common branch termed ‘A’ occurs once in this branch of thefault tree.Since ‘A’occurs inotherpartsaswell (previouslyshown) itmustbelooked at more carefully in terms of possible interventions, and possiblecommonmodefailures.Interventionswouldhaveachanceofpreventingerrorscausedbycommonmodefailureswithin‘A’.Thesub-faulttree‘A’isthereforealsoacriticalelementoftheoverallanalysisofWDLs.3.2.4SOP/formalerrortrapsfailThis element is not extended as part of the fault tree analysis since manydifferent error traps and procedures are used across the industry and indifferent fleets and operations. Suffice to note that error traps involving justflight crew do not prevent allWDLs from occurring. However interviews andsurvey data related to ‘close-call’ anecdotes do show that WDLs are oftenprevented by the current error trapping procedures in place. Therefore careshouldbetakenbeforechangingordismantlingthecurrentsystem.3.2.5AmbiguitiesnotnoticedorrejectedClearlyambiguitieswillexistwherethewrongplatformhasbeenacceptedbyacrew(whether installationorvessel). Inotherwordsnoteverythingabout thewronglyselectedplatformwillmatchtheintendedplatform.Thesemaybequitesmall.InmostcasesoftheWDLeventstheambiguitiesweresimplynotnoticed.Usually this isdue to thedecoy issue; adecoy-pairing characteristic (DPC)hasclosed the cognitive and CRM process of scrutiny despite other platformcharacteristics being clearly ambiguous. However in some cases ambiguity isnoticedbutisdismissed.Thisisnotusuallycausedbyanintentiontoviolateortotakearisk,but isusuallyduetoconfirmatorythinkingprocesses(relatedto

43

confirmation bias). The ambiguous feature is rationalised in some way oranother.Forexampleapilotmayconsiderthattheirexpectationoftheplatformstructuremusthavebeenincorrectonseeingthedifferentstructure.3.2.6FullfaulttreeThefullfaulttreerelatingtovisualacquisitionofthewrongplatformisshowninFigure3.9,below.Itismadeupofalltheelementsdiscussed.3.2.7Commonmodeissues(sub-faulttreesA,BandC)Because ‘A’, ‘B’ and ‘C’ are common extensions of a number of higher-levelbranches in the fault tree, they are both threats and opportunities. They areopportunities because single interventions have the opportunity to preventmultiple failures within the error generating process. However they are alsothreats for the same reason, because any common elements feeding up intodifferent sidesofa fault treemean thepotential fora single issue tocause thehighlevelfaulttooccur.Several areaswithinbothA,BandC canbe foundwhere interventions canbemade.Inthispartofthefaulttreethesearearoundautomationmanagementandtaskchanges(A),andaroundinformation,expectationmanagementandtacklingconfirmationbias(forsub-faulttreeB).

44

Figure 3.9 – full fault tree branch for all visual acquisition errors.

45

3.3 Crew followed FMS to incorrect platform (routing to the wronghelideck)ThisisthesecondtypeofWrongDeckLandingmode,asshownbelow.

Figure3.10–locationoftype-2WDLsonthefaulttreeTheFMSroute(orplatform/waypoint)canbewrongforvariedreasons.Astheextendedfaulttreeshows(Fig3.9,below),itcanbecausedeitherbythewronginformationbeinggiventothecrew,bythecrewputtingthecorrectinformationwronglyintothenavigationprocess,orbythedatabasebeingincorrect.Withouttrapping,anyoftheseleadtoasituationwhereaWDLisalmostinevitable.ComparedtoWDLscausedbyflyingtoanunintendedplatform,theseWDLsareuncommon,andthereisnoparticulartrend.Ontheexpansionofthetype-2WDLfaulttree(Fig3.11,below)nosingleerrorboxcontainsamajorityofevents,orevenabigproportionof theseWDLs,andthis is problematic for solutions. The generation of each error type leading toWDLs in this area is quite different, is minor, and would require differentsolutionspriortotrapping.Resolvingtheproblemcannotthereforebeachievedbyasingleorgeneralsolution,butrequiressolutionstoalloftheseerrors.ThismaybeinefficientgiventhateacherrortypemayonlyaccountforatinynumberofWDLs,butwouldrequireabespokesolution.

46

Figure3.11–faulttreeexpandingreasonsfortheFMS/NavbeingwrongWhatthisshows,alongwiththefrequenciesfromtheanalysis,isthatthereareavarietyofwaysinwhichthewrongrouteorplatformbecomesthenavigationaltargetormissiongoal,butnonearecommon.

47

PART4-DATAANLAYSISSECTION

48

4.1DatacollectedVariousformofdatawerecollectedandanalysedfromthefollowingsourcesObservationflightsTwenty-six hours of in flight observationswere completed on theAW139 andthe S92 (62 sector observations and 51 offshore landing observations). Sevenapproaches and landingswere observed from the sidewindowof theAW139,theremainderfromacentralseatdirectlybehindthepilots(jumpseatonS92).Headsetswerewornsothatcrewcommunicationscouldbemonitored.SimulatorsessionsNineandahalfhoursofsimulatortimewasspentontheAW139andtheEC225.EighthoursofAW139simulatortimeconcentratedonallproceduresthatcouldhave relevance to wrong deck landings, and included IFR, VMC and nightprocedures.EyetrackingwasusedontheSME(experiencedpilot)bothtorecordthesessionandtoassesswhatidentificationcueswerebeingusedtolocateandverify the platform. Ninetyminutes of EC225 simulator timewere devoted towrong deck landings at Bristow, Aberdeen. Thiswas used to explore platformidentification and navigational issues, and included the use of eye-tracking ononeexperiencedpilot.IncidentanalysisIncidentsreportswereusedtogainanunderstandingoftheissue.Basicanalysiswas performed on a sample of WDL incident reports. The previous overallanalysisbytheCompanywasalsoutilised.OnlinesurveyOne hundred and seventeen (117) pilots filled in a narrative online survey(internationally). The survey was voluntary, and attempted to assess pilotperceptionofWDLcauses,actualincidentsand‘closecall’events.InterviewsTen pilotswere interviewed formally, for between 25minutes and 1 hour 20minutes). As well as open interviewing techniques, most interviews alsoincluded various elements of cognitive task analysis to explore the cues anddecisions of platform identification. Informal conversations tookplacewith12pilots(oftenafteranobservationflight).Thesewerenotrecordedbutpointsofinterestwerewrittenup.

49

4.2OnlineSurveyTheonlinesurveywasfilled-inby117pilots.Itwasintwoparts;demographicsandnarrativequestions.Thedemographicscollectedwereasfollows(Table4.1):Table4.1–demographicsofthesampleNumberofcaptains 94NumberofFirstOfficers 23NumberofTrainers 37Total(NumberofParticipants) 117 Experiencebrackets 0to3 54to6 67to9 1110to14 1615-19 1720to30 3730plus 25The narrative section aimed to collect information from pilots related to fourtopics areas. Results and analysis from each of these fourwill be described infourseparatesections.Thetopicareaswere:1.PerceivedcommonreasonsthatWDLsoccur2.Perceivedhardware(design/infrastructure)andproceduralvulnerabilities3.Perceivedtrainingvulnerabilities4.ActualEventsforanalysis(WDLsornear-WDLs)Thequestionsaskedwere:1.Whatdoyouthinkarethemostcommonreasonsforwrongdecklandings?2. Apart from training, what could be improved to help prevent wrong decklandingsacrosstheindustry?3.Ifyouweretraininganinexperiencedcrew,whatwouldbeyouradvicetohelpyourtraineesavoidlandingonawrongplatform/vessel?4.Whatistheclosestthatyouevercametolandingonthewrongdeckorvessel?Pleasedescribewhatwentwrong(andwhy,ifpossible)

50

4.2.1Topic1response(PerceivedcommonreasonsthatWDLsoccur)The pilot population (based on the survey sample of 117) expressed a widerangeofideaswhenaskedQuestion1(“Whatdoyouthinkarethemostcommonreasons for wrong deck landings?”). Seventy-four different perceived reasons(categories) were deduced by thematic analysis of 316 comments. Where anindividualmadetwoormorecommentsinasinglecategory,thesewerecountedas one comment, meaning that the number of comments in any category isequivalenttothenumberofpilotswhogavethatreason.The74categoriesfellintoeightbroadclassesshowninthelistbelow(Table4.2)in descending order of comment frequency by pilots. The full category list ofreasonsputforwardisshowninAppendix1,alongwithafrequencyhistogram.Table4.2–Eightmaincausalclassesexpressedbypilots

Classofcausalcomment Noofcategories

Noofcomments

Pilotactions,performanceandhumanfactors 41 183Signage/Lighting 7 39Rigcharacteristics 8 37Operationalandgeneralconditions 6 25FMS/NAVissue 4 19Helipad(orvessel)communications 4 8Ineffectiveproceduresorchecklists 3 3Visualcockpitrestriction 1 2Themeannumberofcommentspercategorywasjustoverfour,andtherewereno ‘stand-out’ categories (thehighestnumberofpilots commentingona singlecategorywas13–“complacency”,andthe lowestwasone;whichwas thecaseformanycategories).Inessence,thisshowsthatnocommonreasonisperceivedacross the pilot community; pilots see a wide range of issues as beingcontributory.Thismayreflectthedifficultyoffindingandacceptingasolution.Very few pilots gave more than three comments. The spread of differentcommentsdoesnotshowageneraltrend,butdoesshowdifferencesofopinionamong the community. Perhaps the largest difference is whether WDLs arecaused by pilots or by the system within which they work (including SOPs,infrastructureandequipment).Byfarthe largestcategoryofperceivedcauseswasof ‘pilot-related’ issue(firstcategoryabove).Indeedthiscontainedoverhalfthecategoriesandwelloverhalfthetotalcomments.

51

A largenumberofpilotsofferedpilot-relatedreasons forboth theevent (their‘closecall’anecdote,question4inthesurvey)andascausalreasonsforWDLsingeneral (question1). Somealsoprovidedanecdotesofwrongdeck landingsor‘close-calls’ in question 4 that were self-critical, including comments such as‘complacency’(appliedtothemselvesortheirothercrewmember).Thisappearstobeahealthyattitudetotheproblem,showingthatpilotsseethattheyhavearole to play in preventing WDLs. This may help to facilitate acceptance ofinterventions.Thesepilotsappearedtobeequallylikelytooffercritiquearoundsystemelements,andoverall,manypilotsemphasiseWDLsassystemgeneratederrors. They point to the signage, appearance, procedures or companies asgeneratingWDLs.However,thereisasizablenumberofpilotswhoappeartostronglybelievethatwrong deck landingsmainly happen due to poor performance of other pilots.They used phrases such as “complacency”, “unprofessionalism”, “over-confidenceand“laziness”.Someofthesesamerespondersgavestronglywordedresponsestorequestsforexamplesor‘closecalls’inquestion4,suchas“Ihavenotcomeremotelyclosetolandingonawrongdeck”.Such responses to question 4, combined with the comments to all otherquestions suggest that a considerable group of pilots exist that believewrongdeck landings will not happen to them. Such attitudes must be factored in iftraining is considered. This will be explored further in the section relating toquestion4.

52

4.2.2 Topic 2 (Perceived hardware (design / infrastructure) andproceduralvulnerabilities)Participants were asked the question: “Apart from training, what could beimprovedtohelppreventwrongdecklandingsacrosstheindustry?”Thequestionwasspecificallyaimedatelicitingthoughtsonnon-pilot(i.e.non-training) improvements. From answers to this question, the perceivedvulnerabilities inherent in thesystemcanbere-validated.Nonovelordetailedideaswere proposed. The categories of answers given are shown in Table 4.3below.Table4.3–Commentsproposingtoimprovementsthatcouldbemade

ImprovementcategoryNumberofcomments

Alighting/signagesystemnotifyingdeckavailable/unavailable 52Improvedsignage/deckmarkings 48Helideckcrewactions/comms/clearances 23Better/differentcrewactions(other) 20BetterconfirmationofvisualIDbypilots 16More/betternavigational/commsequipment/FMS 15BetterconfirmationofFMSposbypilots 8ImproveSOPs 5Improvecockpitdisplay 2Improvechecklists 2Alwaysflyautomatedapproaches 2Schedulingvarietyintotheroster 2EmphasisevulnerabilityofWDLstopilots 2Offerpilotincentivesandrewards 1Notably,justoverhalfofallcomments(100outof198)suggestedchangestothelanding platform (including signage, markings and lighting) to improve visualidentification.Ofthese,thesingle largestgroupofcommentsproposedfittinganew type of simple and clear visual deck clearance system. Most of thesesuggestedgreenlightsforcleardeckand/orredlightsforaprohibitedorcloseddeck.Someofthesecommentsdiscussedflags,signalsorflaresforthispurpose.Almost as many comments made up the second largest category: improvedsignage / deckmarkings.Most suggestions related to size and clarity of signs.Almostall comments in these two largecategories suggested that thenumber-oneproblemthatpilot’swantedhelpwithwasthedifficultyofobtainingsimpleunambiguous visual confirmation that they had selected the right landing sitebeforecommittingtolanding.The next largest category discussed improvement to the HLO or helideckcommunicationorclearancetolandsystem.SomesuggestedtheHLOshouldbevisual with the helicopter and issue a clearance to land. Others discussed

53

clarifying communications. In common with the two largest categories, mostcommentsinthisgroupappearedtoshowadesireforaclearsignalconfirmingthattherighthelicopterwasapproachingtherightdeck.Comments directed towards improvements in pilot performance or behaviourmadeup less thanaquarterofallcomments(47commentsoutof198).Theseweremadeupofthreemaincategories;crewactions(mixedcomments),betterconfirmationofvisualID(theneedforpilotstochecktheplatformidentitymorethoroughly)andbetterconfirmationoftheFMSposition(theneedtochecktheFMSpositiononfinalapproach).Afewcommentsdiscussedmakingpilotsmoreawareoftheissueorinducingthemwithrewards.Inconclusion,thecommentsreinforcedthegeneralfindingfromotheraspectsoftheresearch, that themain issuepilotsstrugglewith isamethodtocheckthatthey are approaching the intended platform before committing to land. Thecomments reinforce the suggestion that there is an informational gap at thispointinthesystem.

54

4.2.3Topic3(PerceivedTrainingVulnerabilities)Participantswereasked:“ifyouweretraininganinexperiencedcrew,whatwouldbeyouradvicetohelpyourtraineesavoidlandingonawrongplatform/vessel?”209commentswere received (not including repeat comments).ThecategoriesofcommentsareshowninTable4.4,below.Table4.4–Commentsproposingadvicetoinexperiencedpilots

CategoriesNoofpilotcomments

Advicefordeckconfirmationonfinalapproach 117EmphasiseFMScheck(onapproach) 15Emphasisevisualcheck(finals)/readname 35EmphasiseusetheRADARtocheck 5EmphasiseuseNDBs(wheneveravailable) 3Bothpilotsmustcheck/confirm 12NeedtovocaliseID(readaloud) 3Morefocusonfinalconfirmation 13Establishcommunicationwithrig/vessel,HLOconfirmation 13Usemultipleinformationsources/don'ttrustsinglesources 9Maintainsterilecockpitonapproach 4Confirmdeckearly 3Donotconfirmthedeckearly 1Flyalongerstabilisedapproach 1Generaladvice 50Comply/paymoreattentionto,checklists/SOPs 28Emphasiseconsequencestopilots 1Communicationbetweenpilots 2Tapexperienceofothers 1Generaldiligence,attention,taketime 18Contingencies 19Goaroundifindoubt 5Flyoverorcircletherigpriortoapproach(orifindoubt) 14Planningandenroute 20Checkpositionreports/updatesenroute 2Continuedmonitoringoftrackanddistanceenroute 1BetterPlanning/Preparation 17Helplessness 3Trainingcannothelp 3Mostcommentsweregeneral intheirapproach,anddidnotgo intodetail.Themajority of comments advise trainees to put more focus on identifying andchecking the platform on final approach, either as part of SOPs/checklists or

55

generally. More focus on planning and preparation was also popular advice.Someparticipants offered practical operational advise such as lengthening thefinalapproach,alwaysoverflyingtherigorseekingclearerHLOconfirmation.Nodetailsweregivenof anyproof that theproposed training interventionswork.Thegeneraltonewasofpilotspayingmoreattentionandcheckingorplanningmoreoftenandmorecarefully.Whilstundoubtedly important,suchadvicewillnot reduce the numberswrong deck landings beyond its current level. Only atinynumberofpilotsdisplayedahelplessattitude;commentingthatWDLscouldnotbereducedunlesstheinfrastructureischanged.

56

4.2.4Topic4-ActualEventsforanalysis(WDLsornear-WDLs)Ninety-eight responses were given to Q4. Most were anecdotes of WDLs or‘close-calls’ as requested (62). Of these, 7were realWDLs experienced by therespondent,4wereWDLsthattheyknewof,and51describedfirst-handnear-WDLs (close-calls).A largeproportionof responsesweredenials that thepilothadeverbeenclosetoexperiencingaWDL(32).Theremaining4wereunrelatedcomments.ThetypeofanecdotewascategorisedasinTable4.5below.Table4.5–typesofresponsetoQ4

Categoryofresponse/anecdotetoQ4Noofresponses

ActualWDLs 73rdpartyWDLdescribed 4Closecall(statedassomeoneelse'serror/fault) 7Closecall(other'scause,avertedbyrespondent) 5Closecall(acceptanceofsomerole/error) 27Closecall(nodescription) 12Notyet'typeofcomment 9No(neutraltone) 5No(firmandexpanded) 18Non-relatedcomment 4Onebreakdownperformedwastheattributionofeach ‘close-callanecdote’(inotherwordsdidtherespondentattributeittosomethingorsomeone,andifsowhat or whom?). Forty-one of 51 ‘close-call anecdotes attributed at least onereason for occurring. Table 5 (above) shows that of these 41, 27 respondentsincluded themselves as all or part of the reason why it happened. Twelverespondentsspecificallyattributedthecausetoothersortoatechnicalcause.Ofthese,5wentfurthertopointoutthattheiractionshadavertedtheWDL.One important point emerging from this is that only about half of pilots whoansweredthequestionreportedthattheyhadexperiencedsuchanevent(eitherWDLornear-WDL)inwhichtheycontributedcausally.ReasonsgivenforexperiencingWDLsorClose-calls(Q4)As stated, sixty-two incidents of either WDLs or close-calls (WDLs that werenarrowlyavoided)weregiven.142reasonsweredirectlyofferedbyparticipantsforthese62events(thereforeaveragingovertwoperevent).The thematic analysis structure that emergedduring theanalysisofQuestion1(Reasons for wrong deck landings) was found to provide most categoriesrequired for the analysis for Question 4 (real events). The only additionalcategoriesthatwereneededforQ4wereasfollows:

• Rigobscuredbycockpitstructure(1)

57

• Rigobscuredbehindotherrig(2)• Forgottogetdeckclearance(1)• Anotherrigorvesselneartotarget(27)• IMC/VMCintermittent(1)

ThismeansthattheabovefivereasonswerenotgivenbyparticipantswhentheywereaskedwhattheythoughtcausedWDLs(Q1),butwereneverthelessofferedby participants when asked to describe actual WDLs or close-calls (Q4). Thereasonscouldthereforerepresentanactualthreatthatisnotwellperceivedbycrews.Equallytheycouldrepresentathreatthatcrewssimplydidnotconsiderwhenansweringquestion1.Figure 4.1 (below) indicates where reasons given for WDLs (Q1) differ fromreasonsgiven forpilot’sownexperiencesofWDLSor closecalls (Q4).The redlineistheformerandbluelinethelatter(notallcategoriesareshown).Thefarright hand side shows the peak created from the category mentioned above(‘Anotherrigorvesselneartothetarget’).This isclearlythe largestdifferencebetweenthetwosetsofdata.

58

Figure 4.1 – This shows reasons given forWDLs (Q1 - red) and reasonsgiven forpilot’sownexperiencesofWDLSorclosecalls (Q4 -blue).Notethat not all reasons are shown (due to size) and also that any categoryscoring1orbelowonbothwasomitted.

0

5

10

15

20

25

30Complacency(theword)

LackofAttention/vigilance

Distraction

Stress

Workloadorextratasksinninalapproach

Rushing,hurrying

Taskprioritisationissues

Unfamiliarityofcrew

commit/IDplatformbeforeninalapproach

Low/poorSA

NotfollowingFM

Son/duringninalapproach

Notfollowingchecklist

Notpositivelyidentiniyingplatform/instalation

Signagepoor(generalcomment)

Signagedifniculttoread

Signstoosm

all

Similarlookingboats/vessels

Appearancenotdistinguisable/lackofcues

Installations/vesselsinline

Shuttlenlights/multiplelandings

BadWeather/vis.Etc

Rigpositioninformationwrong(e.g.indatabase,notup

Coordinateschangesasvesselm

oves

Clearedtolandtooearly-notyetvisual

Restrictedvisionofonepilot,meaningcannotread

Anotherrigorvesselneartotarget

59

Table 4.6 (below) shows the categories of interest emerging from Question 4responses(eitherduetotheirtotalnumberorduetodifferencewithQuestion1totals).ThetablegivestheequivalenttotalsandpercentagesforbothQ1andQ4.Thoserepresentingover4%ofcommentsinquestion4arehighlightedingrey,andthehighesttotalisinred.Table4.6–Categoriesofinterestinreasonsgivenforrealexperiences

Across the board, reasons given for actual events (Q4) paint a less varied orwide-rangingpicture than thehypothetical reasonsoffered forWDLs fromQ1.Themajorissuesemergingfromtheanecdoteswereasfollows:

CategoriesQ1Num-ber

Q1%

Q4Num-ber

Q4%

Complacency(theword) 18 5.7% 4 2.8%LackofAttention/vigilance 10 3.2% 2 1.4%Distraction 7 2.2% 2 1.4%Fatigue 11 3.5% 2 1.4%Workloadorextratasksinfinalapproach 16 5.1% 0 0.0%Expectancy-seesrigtheyexpecttosee 8 2.5% 0 0.0%Unfamiliarityofcrew 5 1.6% 5 3.5%Low/poorSA 7 2.2% 1 0.7%SelectwrongpositionorcoordinatesinFMS 8 2.5% 0 0.0%Notfollowingprocedures(general) 9 2.8% 0 0.0%Notfollowingchecklist 7 2.2% 2 1.4%Failuretocheck/readnameonfinals 13 4.1% 0 0.0%Notpositivelyidentifyingplatform/installation 10 3.2% 2 1.4%Signagepoor(generalcomment) 16 5.1% 1 0.7%Signagemissing,notvisibleorhardtofind 8 2.5% 1 0.7%Nearbyrigslooksimilar 13 4.1% 15 10.6Similarlookingboats/vessels 2 0.6% 13 9.2%Installations/vesselsinline 2 0.6% 6 4.2%Alotofrigsinarea 6 1.9% 5 3.5%Shuttleflights/multiplelandings 4 1.3% 9 6.3%BadWeather/vis.Etc. 12 3.8% 7 4.9%Goodweather 2 0.6% 5 3.5%Rigpositioninformationwrong(e.g.indatabase,notuptodate,moved,etc.) 11 3.5% 3 2.1%

Imprecise non-updated position reports frommovingvessels 5 1.6% 2 1.4%

Anotherrigorvesselneartotarget(‘decoy’) 0 0.0% 27 19.0%

60

Firstly,averylargenumberofrealWDLs(orclosecalls)occurspecificallywhenanother vessel or rig is very close to the target vessel, effectively forming a‘decoy’. The proximity and arrangement were emphasised far more than theappearanceof thedecoy. Inthe initialopenresponses(question1)noneofthe117 respondents expressed this idea specifically, yet in the anecdotal question(Q4) 27 out of 62 pilots referred to it specifically. Question 1 did generategeneralstatementsaboutinstallationsandvesselslookingsimilarorbeingclosetogether (e.g. “similar looking rigs nearby”). However it was clear from Q4responses that a specific second ‘decoy’ target plays a major role in mostincidents, as opposed to simply having many decks in the area, or platformsaroundthatlooksimilar.Secondly, a considerable number of events have involved this decoy lining upwiththerealtargetinapproachdirection(about10%).ThiswasmentionedatafargreaterrateinQ4thaninQ1.Thirdly, shuttle flights appear particularly vulnerable, and this issue wasmentioned often. This could simply reflect frequency of landings, but it isprobable that the nature of shuttle tasks makes these operations morevulnerable.Fourthly, both good and bad weather were mentioned as contributing. Goodweather was mentioned at a higher rate in Q4 than Q1. However it is worthnoting that poor weather, and specifically poor visibility (including haze, rainandgeneral lowvizconditions,wasstilldeemed tobeamajor factor,andwasmentionedmoreoftenthangoodweatherinbothquestions.Other factors thatwere deemed to have played a role such as signage, humanfactors,fatigue,appearanceetc,butthesewerenotmentionedinlargenumbersofcasesinQ4,andwerespreadwidelyandatlowfrequency.Most pilot-related issues (including complacency, lack of attention, fatigue,stress, workload, distraction and expectancy) were less evident in the Q4responsesthanintheQ1responses.In summary, theoverallpicturepainted from the real events (Q4)washeavilyconcentratedon a fewmajor issues, and this contrasted to thewide spreadofreasonsgivenbypilotswhensimplyaskedtoprovidereasonswhyWDLsoccur(Q1).RealWDLsandclosecallsappearmorepredictableintermsofcausethanQ1responseswould suggest. It isprobable thata secondplatformorvessel inclose proximity to the target creates the conditions for most wrong decklandings,andifcertainsituationalfactorsareapparent(shuttleflights,approachdirectionalignment,issuesofvisibility)thenthepossibilityofaWDLisrelativelyhigh.

61

4.2.5AnalysisofattitudetowardwrongdecklandingsAnalysis combining question 1 and question 4 further considered the attitudepilotsheldtoWDLs.Twoofgroupswereofinterest,formedfromtheanalysisofanecdote type (Table 4.5). Group one were those 27 respondents in Q4 whoincluded themselves as all or part of the reason why an event happened (i.e.admittingthattheiractionscontributedtoanear-WDL).Grouptwowerethosepilotswho firmly stated that theyhadneverhad aWDLor close call. Group1were27pilots,grouptwo19.TheQ1responses(reasonforWDLs)weretracedbackforpilotsinbothgroups.Itwas found thatgroup-1pilots (thosedescribinganear-eventasbeingpartlytheir cause) gave 36 causal comments forwhywrong deck landings occurredwhentheyhadansweredQ1.Group2(thosestronglydenyinghavinghadsuchan event) were found to have given 22 reasons for wrong deck landings inquestion1.All the question 1 responses (both groups) were categorised as either pilot-attributable or system attributable causal factors. In other words the reasonsthatthesepilotsgaveastheirperceptionsofwhyWDLshappenweretaggedaseither pilot or system caused. It was expected that Group-2 pilots who madestrong denials about having been close towrong deck landings (in Q4)wouldattribute causes to other pilots in their responses to Q1 (due to normalattribution bias) while those admitting a close call in Q4 (Group-1) would bemore prepared to attribute system causes in Q1, even though they admittedsome responsibility. This was found to be the case, and was supportedstatistically.Table 4.7 (below) is a chi-square 2 x 2 contingency table comparing the twogroups, in terms of their propensity to give pilot-related or system-relatedfactors as reasons for WDLs in answer to Question 1. It shows a statisticallysignificantdifferencebetweenthetwogroupsandtheirQ1answers(Chisquare=5.0128,p=0.025161),whichisbasedaroundtherecognitionofsystem-relatedcauses. In responding to Q1, group-1 pilots tended to splitWDL causes fairlyevenlybetweenpilotandsystem.Group-2pilotswere justas likely topoint topilot-relatedcauses,butfarlesslikelytopointtosystem-relatedcauses.

62

Table4.7–Chisquare2x2testonGroup1andGroup2reasonsgivenforWDLs

Group1(OwnCloseCall)

Group2(Stronglydenyclosecall)

MarginalRowTotals

Pilotrelatedcauses 21(24.83)[0.59] 19(15.17)[0.97] 40Systemrelatedcauses 15(11.17)[1.31] 3(6.83)[2.15] 18MarginalColumnTotals 36 22 58Even when additional pilots are included into group-1 (those who simplyexpressed that they had had close calls without stating the reason why), thestatisticisstillsignificant(chisquare3.8813,p=0.048825),asseeninTable4.8below.Table4.8 -Chi square2x2 testonGroup1 (including thoseadmittingaclosecallwithoutgivingareason)andGroup2.

Group1(OwnCloseCallORneutral)

Group2(Stronglydenyclosecall)

MarginalRowTotals

Pilotrelatedcauses 33(36.54)[0.34] 19(15.46)[0.81] 52Systemrelatedcauses 19(15.46)[0.81] 3(6.54)[1.92] 22MarginalColumnTotals 52 22 74Theconclusionmustbedrawnthatthereareaconsiderableproportionofpilotswho believe thatwrong deck landings are a problem for other pilots, but notthemselves. Most of these have not had a WDL or close call, which acts asconfirmatoryevidencetosupporttheirview.Thisgroupwillbethemostdifficultintermsofintroductionofnewproceduresandtraining,becauseeithertheydonot currently accept that WDLs are something that they are potentiallyvulnerableto,ortheybelievethattheymanagethethreateffectivelyalready.

63

4.2.6MainconclusionsfromsurveyfindingsReasonsforWDLsWhenaskedtocommentonthisgenerally,pilotsgavemanyanswers,coveringatleast 74 reasons, but no outstanding trend was found. Most pilots gave somereasons relating to pilot performance andmany also gave reasons relating toinfrastructureissues(e.g.signage,appearanceandclusteringofplatforms).Howeverwhen commenting on actual events they had been involved in (Q4),muchstrongerandnarrowerthemesemerged.Importantly,theissueofasecondplatformorvesselclosetothetarget,whichwasspecificallymentionedasbeingafactorin27experiences.This ‘decoy’ platform is what draws the pilot away from the main target,facilitating the specific triggering error that begins the WDL process.Confoundingissuessuchaspoorvisibilityorhaze,thedecoybeingalignedintowind, shuttle operations and similar appearance all acted as promoters andfacilitatorstotheWDLtriggeringerror.SystemimprovementsMostpilotspointedtophysicalinfrastructureimprovementstomakedeckmoreidentifiable(e.g.betterandbiggersigns)ortoconveylandingstatus(e.g.anewlight system to show clear decks). Better communicationswithHLOswas alsoputforwardfrequently.AdvicetopilotsonavoidingWDLsPilots would advise inexperienced colleagues to focus more on the preciseidentification of the platform on finals (e.g. check of FMS, visual and radar)prepare thoroughly, adhere to procedures and checklists, and generally paymoreattentionanddonotrush.Theyalsoadvisegoingaroundoroverflyingtheplatformifatallunsure.Ingivingsuchadvise,thepilotsdemonstratethattheybelievethatsomeWDLscanbeavoidedbydoingthesethingsthemselves.AttitudetoWDLsOnlyaverysmallnumberofpilotsbelievethatWDLsareinevitablebecausetheyare caused entirely by the system inwhich theywork, and cannot be trainedagainst.Attheotherendofthespectrum,alargergroupbelievethatWDLsarethe resultofpoorpilotperformance towhich they themselvesarenot subject.Both groups may be difficult to obtain buy-in from in terms of training andproceduresfordefenceagainstWDLs.Howeverthemajorityofpilotsappeartobelieve thatWDLs are caused by amixture of human and system factors, andshowthattheyfeelvulnerabletohavingone(usingstatementssuchas“Ihaven’t

64

had one yet…”). In general this shows that most pilots would be prepared toengageinsolutions,becausetheywouldfeelithadrelevancetothem.4.3PilotInterviewsPilotswere interviewed using open and conversational techniques. Theywereaskedtotalkabouttheissueofwrongdecklandingswithoutprejudice,andtheinterviewer used prompts tomaintain the conversation on the issue ofWDLswhiletryingtoavoidleadingtheparticipant.Pilot interview responses tended to expand upon the themes that the surveydata picked up. Most pilots commented on the issues of infrastructureappearance as being a particular problem, and of poor signage making theprocessofidentificationdifficult(evenimpossible)toclosebeforecommittingtoalanding.Manyexamplesweregivenofeach.All pilots interviewedwere able to relate either aWDL incident that they hadbeeninvolvedin,ora ‘close-call’. Inthesamewayasthesurveyresponses, themain theme emerging from the actual incidents tended to be around a decoytarget of some sort nearby that was wrongly identified as the main target.Initially, the issue of appearance was not emphasised by many interviewees,although when pressed most said that the ‘decoy’ was a similar type ofinstallation or vessel. Shuttling operations and low visibility played a part inmanyoftheanecdotes.Thereweredifferencestotheinterviewdata.ThetwomostnoticeableweretheissuesofdistractionandCRM,whichemergedoftenininterview,butwererarelymentionedinthesurvey.Thiscouldhavebeenduetothedepthenabledbytheinterview as opposed to surveys. Many pilots stated that they had accepted acolleague’splatform identificationwithoutquestionor that their colleaguehadaccepted theirs. Also,manyparticipants said that they or their colleaguewere‘out of the loop’ during an important period where the deck was selected(usuallywhenPNF,due toenrouteplanningandcommunication issues).Theyrelated experienceswhereby theyhad first visually engagedwith theplatformafterthePFhadalreadyselectedandconfirmedit,sometimesonfinalapproach.Participantswerealsoaskedtotalkthroughtheprocessofacquiringthecorrectplatformduringasector(atypeofcognitivetaskanalysis).Inlinewithinflightobservations, it was clear from the analysed responses that pilots sometimesstart the identificationprocessmanymiles out from theplatform.At this timethey usually look in the direction shown on the FMS (usually 12 o’clock) andattempt to obtain a sighting of the platform. At this point, most claimed toidentify the platform only as belonging to a group of installation types (e.g.accommodationplatform,jack-up,vessel,productionplatform,etc.).Astheyneartheselectedtarget,theylookforclearerandclearersignsbywhichtoidentifyit.

65

Itisofsignificantinterestthatthepilotsspeakintermsoftryingtoidentifythefeatures on the selected structure as belonging to the intended target, asopposed to identifying features thatdidnotbelong to the intended target.Thelaterwouldbelesspronetonaturalconfirmationbias.Allpilotssaidthatitwasnormal(necessary)tosetupthehelicopteronthefinalapproachtrackbeforebeingabletoidentifytheplatformfromitsidentificationplate. Thiswas borne out by in flight observations. Pilots then discussed how,after setting up on the final approach track, the identification plate remainsunreadable for a considerable time and usually only forms part of the finalchecksbefore landing.All pilots showed frustration at the identificationplatesonthestructuresandships,claimingthattheyweretoosmall,inconsistent,oftendirtyorobscured, indifferentplaces,notonallsidesofthestructure,andonlyvisibletothePFfromthepointatwhichtheletteringislargeenoughtoread.Itwasclaimedthatinmanycases,thesignagewassopoorthattheplatformcouldnotbeproperlyidentifieduntilafterthecrewhadcommittedtoland.Inconclusion,theinterviewanalysisshowedaprocessbywhichstructuresareselectedearly(beforetheyareidentifiable)andnotfinallyacceptedastherightstructureuntillateonapproach.Thisperiod(calledinthereportthe‘transitioninterface’) couldclearlybemanymilesandmanyminutes in length.Even frominterviews,itappearedthatpilotscouldbeusingconfirmatorytechniquesratherthanopenscrutinyduring the transition interface.Such techniquesarenaturaland intuitive, but vulnerable to confirmation bias, which can increasinglyconvinceapilotthatthewrongtarget istherightoneastheyapproachit.Thisissue was triangulated with the in flight observational analysis. From theinterviewsitwasclearthatpilotsfeelthereisoftennowaytoaccuratelyidentifyaplatformuntilitistoolatetoavoidlandingonit(acombinationofpoorsignageand lack of distinguishing features). The idea that a single ‘decoy’ platform isinvolvedinmanywrongdecklandingswasconfirmedwithintheanalysisoftheinterviews.

66

4.4IncidentreportanalysisA sample of 18 company incident reports were analysed in depth; 71 causalfactorswerenoted.Mostofthesefittedtheframeworkemergingfromthesurveyanalysis, and were therefore coded as such. Three new factors were added(labelled ‘NEW’ in Table 4.9). Table 4.9 (below) shows the factors and thenumber of reports continuing each factor (the three new factors are at thebottom).Table4.9-FactorsasinterpretedfromsampleofcompanyWDLreports

FactorsinterpretedfromWDLincidentreports

No.ofreportsindicatingthefactor

Distraction(PF) 2Distraction(PNF) 5Fatigue 1PoorPre-flightpreparation 3NotfollowingFMSon/duringfinalapproach 1Notfollowingprocedures(general) 1Notfollowingchecklist 1Failuretocheck/readnameonfinals 2Notpositivelyidentifyingplatform/installation 5Signagepoor(generalcomment) 1Signagemissing,notvisibleorhardtofind 4Signstoosmall 1Nearbyrigslooksimilar 2Similarlookingboats/vessels 4Appearancenotdistinguishable/lackofcues 3Similarplatformnames 5Installations/vesselsinline 2Alotofrigsinarea 1Shuttleflights/multiplelandings 2BadWeather/vis.Etc. 2Goodweather 2Rig position information wrong (e.g. in database, not up todate,movedEtc.) 2Imprecisenon-updatedpositionreportsfrommovingvessels 1HelideckCommunicationpoorordifficult 4Crewsgivenwronginformation(wrongrigplanned) 2Anotherrigorvesselneartotarget 9Compositerig-wrongplatformonsamerig(NEW) 1Sun/glare(NEW) 2Notinformedofothervesselwithsimilarnameinarea(NEW) 1

67

Themostnotableresultwasthefrequencyof‘Anotherrigorvesselneartarget’(9 instances). This is the category that describes where a specific ‘decoy’platformhasplayedamajorroleintheincident.Itisprobablelargerthanshownhere,butonlycaseswherespecificreferencewasmadetoadecoy-typeplatformas playing an active rolewere coded as such. This category emerged from theanalysis of the anecdotes in the online survey, having not emerged from themoreexpansivegeneralpilotperceptionsofWDLcauses. Italsoemerged fromtheinterviews,particularlywherepilotsrelatedtheirownexperiencesofWDLsor ‘close-calls’. Hence, from three converging sources of analysis from threeindependentdatasetsrelatingtoactualeventcausation,itappearstobeafactorthatiskeytotheunderstandingofwhyalargeproportionofWDLsoccur.In terms of pilots performance, distraction of PF and/or PM were notablecategories,aswas‘notpositivelyidentifyingthenamepriortolanding’.In termsof infrastructure, similar lookingvessels causeda largeproportionofWDLs. Additionally, missing, hidden, obscured and otherwise hard to findsignage, as well as and similar deck names, all emerged again as importantfactors.ManyoftheWDLincidentstookplaceonvessels,anditwouldappeartherateofWDLsonvesselsisveryhighcomparedtothoseonfixedinstallations(asafactorofthefrequencyoflandingsoneachtype).

68

4.5In-flightobservationsTwenty-sixhoursofinflightobservationwascompleted(62sectorobservationsand 51 offshore landing observations). The observation schedule is shown inAppendix3.Pre-flightFMS programming - The FMSwas always programmed before take off on theobservationflights,neverdeferred.Howeverin interviewssomecrewsclaimedprogrammingdidsometimesgetdeferred.OccasionallytheFMSdidrequirere-programmingen-route.TEMandbriefingTherewereno formal threat anderrorbriefingspre-flight, as far as observerscould ascertain. Occasionally crews didmake comments of a threat and errornature, but rarely in terms of wrong deck landing. One exceptionwas a crewwheretheFOexplainedthat463and462platformslookidentical.Intermsofbriefingsforthenextplatform,therewereanumberofcases(about30% of flight included some such form of briefing, albeit sometimes in thecruise).Commentsusuallyrelatedtotheplatformname,bearingand/ordistanceandwhichseat the landingwouldbe flownfrom.Onecrewdiscussedamissedapproachprocedure.Nocrewsdiscussedhowtheinstallationshouldlook,ortheshapeoftheinfrastructure.CruiseandtransitionMostflightscontainedsomelowworkloadperiodsinthecruise,particularlyonnon-shuttlingsectors.Theobserver’sestimateofthe‘down-time’(lowworkloadtime)variedbetween15%and80%andtendedtorelatetosectorlength.Pilots usually flew the route using the ND/GPS and autopilot. The Transitionfrom arrival to circuit / approachwas observed. Themean distance at whichcrews fly the aircraft away from the FMS track to create an approachwas 3.1miles,andthisvariedbetween0.8and6miles.PlatformIdentificationProcessLesscommunicationdirectly relating toplatform identificationwasheard thananticipated.Procedureswereused,andpilotsdreweachothers’attentiontotheplatformvisuallyhavingidentifiedit.It appeared that the first action on seeing a platform was to draw the otherpilot’sattentiontotheplatform(althoughitisacceptedthatthisisalsothemostobservableactionafter seeing theplatform).For90%of theobservations, this

69

wasaverbalcall(e.g.“visual”or“platformseen”)butonsomeoccasionswasagesture (e.g. pointing) without any verbalisation. For well over half theobservations, theotherpilot immediately confirmedwhen this communicationwas given (e.g. “checked”, “visual”, “got it”, “yeah” etc), and for another largeproportion the other pilot confirmed visual within a short time (about 30seconds). Inmost cases, nomore conversationwas heard relating to platformidentification.Thisappearstoshowthefirststageofacceptanceoccursearlyintheprocess.On occasions, theplatform identificationwasnot ‘closed’ as quickly as normal(sometimes because of visibility or because the crew did not appear satisfiedwiththeidentification).Ontheseoccasions,mostcommentsthatoccurredaftertheplatformhad firstbeen identifiedwereof a closedor confirmatorynature.Forexample:“Thathastobeitdoesn’tit?”“righttrack,rightdistance,sothat’sit”“Craneontheright,it’swhatweexpect”Theimplicationsofthiswillbeanalysedlaterinthesection.In the observational sectors, the mean distance at which the crew visuallyselected the platformwas 6.1miles. The shortest distance (not including ARAapproaches)was1.8milesandthefurthestwas27miles.Onmostoccasionstheotherpilotconfirmedwithnomorediscussion,andsotheplatformacceptanceappearstohavefollowedstraightonfromthefirstsignofvisualselection(about6miles).Hence inmost cases it appeared that the acceptanceof thatplatformwas almost immediate, and it would have to be actively rejected if the errordiscoveredlater.Howeveronmostflightstherewasnoindicationthatthecrewwere actively seeking to confirm or identify the platform further until thedescenttowardsthehelideck.Noticeablyveryfewoftheobservedcomments,questionsorbriefings,discussedwhethertheplatformthathadbeenidentifiedcouldbeanunintendedplatform/decoy.Inmostcasesthedecoywillbecloseandmaylooksimilar.Observations found that FMSwaypointswere suspended very rarely, but thatwaypoints did not disappear on approach. The ‘direct to’ function was usedcommonly.Many crews did not appear to use the radar in short sectors (from what theobservercoulddiscern).Ontheobservedflights,thelevelofRTtrafficwasneverhighduringthecircuitorfinalapproach.

70

Onmany sectors, the PNFwas head-down for long periods during the circuitand/orapproach;includingthelatefinal.Howeverthisvariedconsiderablywithcrews. Some crews rarely had a timewhere onepilotwas head-down.ThePFwasalwayshead-up(withinreason).Anumberoftimesitwasobservedthatduringthefinalturntotheinstallation,thecrewwerenotvisualwith,ormaintainingvisualwith the installation forasignificanttime.ItwasclearthatthePF(onright)wasunabletomaintainvisualwiththeplatforminafinalturntotheleft.Onseveraloccasionsitappearedthatthepilots initiatedtherollout in twophases; firstlybasedonturnrateand/ortiming,andsecondlyadjusttheapproachheadingtothevisualpicture.OnlyfivesectorswereobservedinwhichanysortofFMS/GPS/NAVcross-checkwasverbalisedincircuitoronapproachtotheinstallation.CallsrelatingtoreadingtheinstallationidentitypriortoLDPwerevaried.Manywere a declaration of the platform name (although it could not be knownwhether thepilotswere reading this from theplatform), somewere simply inthe formof “ok”, andatother timesnocallwasmade. In termsof thePNF,onshort finals therewas a largevariety inwhat theywereobserved tobedoing.SomePNFscalledoutheights,headsdownormonitoredspeed.OthertimesthePNFremainedheadsupandvocalisedthattheywerelookingfortheIDplate,orsaidthattheycouldnotseeit.SomePNFwerewitnessedtoreadtheinstallationname in the late stages,whereas several said that it could not be seen in thisphase. Some PNFs used other signage such as the deckmarkings and lifeboatmarkings. Some PNFs called the ID but clearly could not see it. Some PNFsremained head-up and said nothing, whereas others alternated between headdownandheadup.The average time from the first pilot making an identification call (platformname)totheLDPwas43seconds(27timeswererecordingasbesttheobservercould).Theshortesttimewas24seconds,thelongestwas80seconds.

71

PART5-RECOMMENDATIONS

72

5.1RatingsforrecommendationsofthisreportRecommendations are given a rating between 1 and 4 as to how effect theywouldprobablybeinreducingWDLs.ItwillbeseenthattheerrortrappinghasmostpotentialforpreventingWDLs.Theratingsactasfollows:• Rating1.Thiswillprobablyhelptoresolvesomefactorsthatcontributeto

WDLs,butisunlikelytomakeadifferencetoWDLnumbersonitsown.• Rating2.TheserecommendationsarelikelytomakesomedifferencetoWDL

numbers (possibly a small difference) but any effect will probably betemporaryunlesscontinuedeffortisputintoreinforcethemovertime.

• Rating3.TheserecommendationsarelikelytomakesomedifferencetoWDLnumbers,andanysucheffectislikelytolast.

• Rating 4. Thiswill almost certainly lowerWDLnumbers substantially andnoticeably,andwillworkinthelongterm

5.2RecommendationsforavoidingthetriggeringerrorForobviousreasons,itcanbeassumedthatinstallationsandvesselswillalwaysbeopentoconfusion,andcannotberedesignedorredecoratedsothattheyareall different. This means that any solution must not be wholly reliant on thephysicalappearanceoftheintendedlandingsite,andindeedshouldassumethatallvesselslookthesameandallplatformslookthesame.Recommendation1-Lateplatformselection(rating–2)Crewsshouldselect theplatformnosoonerthan5miles(whenonFMStrack),andnotshareanysightingbetweenthempriortothatpoint.Alsocrewsshouldbe trained tocallvisualwithoutdirecting theotherpilot’sattention,andallowthemtofindthetargetindependentlyuntilagivenpoint.Recommendation2–Automationlevel(rating–1)Where possible, PFs should maintain a high level of automation (not flymanually)unless thePNF isundera lowworkloadandable tomaintainvisualcontactwiththeplatform.WhereaPNFisunderanythingbutlowworkload,thePF should fly coupled until late finals, and particularly when manoeuvring toapproach.Recommendation3–Finalturntaskresourcing(rating–1)Final turns. In final turnsontoapproachwhere thePF ison theoutsideof theturn,thePNFmustmaintainclosevisualcontactwiththeintendedtargetintheturnandconfirmthatthecorrecttargethasbeentaken-uponrollingoutusingtheFMStrack.ThePFshouldusetheFMStracktoassistinliningup.WherethePFismanualflyingandontheinsideofaturn,thePNFshouldshadowtheturnontheFMStrack.

73

Recommendation4–Crewtraining(rating–1to2)CrewtrainingintherealfactorsbehindWDLs,particularlywhereknowledgeofthesecanpotentiallyhelpcrewsavoidWDLs.TrainingcouldcoverthefollowingandbepartofCRMsessions;• Typesandwaysoflandingonthewrongdeck(andvulnerabilityofeventhe

bestcrewstoaWDL)• Training on the issue of the visual transition, and ease of mis-selection.

DecoysandtheDecoyPairingCharacteristicsthatcreateathreat.• ImportanceofpracticingmaintainingFMSreferenceuntillate.• Problemsofearlytargetselection• Risk of group-process (directing colleagues’ attention to the platform

immediatelyitissighted,andriskofacceptingagreementasconfirmationofcorrectsighting).

• Useof higher level automation levels, especiallywhen thePNF task-load isveryhigh andwhen the threat of a decoy is high.Doing sowill reduce theworkloadofthePFcompensatingforthePNFworkload.PFmanualflyingatsuch a time leaves a crew very vulnerable to mis-selection, as well asacceptingthatwrongtarget.

• Pilotsshouldbeshownthatitisnotnormalordesirabletoflymanuallyandmaintainvisualcontactwiththeplatformallthetime(whicheversideoftheflightdecktheyareon).Hencethereisariskofreselectingthewrongtargetinthisperiod.ItisthereforeagoodideaforthePNFtochecktherolloutwiththeFMStrack.

Recommendation5–decoycheckandfeaturepriming(rating–2)This is a simplerversionof ‘recommendation7’below. In thepre-flightphase,wherecrewsseethattheyhaveapotentialdecoyplatformnearoninlinewithanintendedplatform,theyshoulddothefollowing:1.Notethethreat,andwhichsectoritison.2.Fromphotosorpictures,findonecertainandvisiblefeatureontheintendedplatformthatisNOTonthedecoyplatform.Havingpreparedthemselvesinthisway,thePNFshouldusethisonepieceofinformationtoselectedtargetatthatpoint. For example if the intended target has a large crane on the left and thedecoydoesnot,thenthecrewmightwriteanote-“ShouldseelargecraneonleftofAB1platform”.Bypreparingthisearly,theywillnotriskchoosingacommoncharacteristictodifferentiatetheplatformatthetime,butwillhavepreparedacharacteristicthatdefinitelydifferentiatestheintendedtargetfromthedecoy.Itisimportantthatthecrewsdonotbecomeoverlyfocussedonthedecoyitself(e.g.choosing it’sunique featuresof thedecoy) incase itcausesthemtoselectthedecoyinerror.

74

Recommendation 6 – Awareness and preparation for potential decoy vessels(rating3or4–forvessellandingonly)Thisisinlinewithrecommendation5butspecificallyforvessels.Inmostwrongvessellandings,theintendedvesselisneverseenorconsideredbythehelicoptercrew;only thedecoyvessel is seenandusedprior to the landing. Somedecoyvesselsarealmostimpossibletodifferentiatefromthetargetvessel.Thereforeitis essential that the crew aremade aware of a potential decoy and any detailpossible if wrong vessel landings are to be avoided. A system is required bywhich all vessels with a helipad that will be potentially in the vicinity of anintended landing vessel are known to the crew prior to take off (e.g‘MarineTraffic’).Ideallythecrewshouldbeabletoseepicturesofthedecoyandthetarget inordertoprepare.Theyshouldselectauniqueaspectof thetargetthatisdifferentonthedecoy,asanerrorcheck.Recommendation7-Decoythreatanticipationandmanagement(rating-3)IMPORTANT-Recommendation7and8arerecommendationsfordesigningandtestingtwogeneralproposalsandimplementingonlyiftrialsestablishthatthereisbenefitandthatnoinadvertentconsequencesemerge.Inmanycases,theexistenceofadecoyplatformcaneasilybeestablishedbeforethesector(evenintheplanningstage)andthereforeavoidanceofitcanbecomepartofthetask.Theexistenceofanothersimilarstructure,particularlyneartheendofthesector(beforetheintendedtarget)shouldgivecauseforconsiderationofthreatpotential.Whereanotherplatformisclosebyandalignswiththefinalapproachtrackorwillappearearlierinthefinalturn,thesemustbeconsideredas threats, particularly in lower visibility. Lowered visibility means thatplatforms will stand out less than usual, in terms of colour and detail, andtherefore the structuremay be quite different to the decoy, and yet still be athreat.This is thesamewithverygoodvisibility (e.g.10kormore) if selectingearly.ItwasnotedinobservationsthatlittleTEMwasconductedbycrews,andalmostnonearoundpotentialwrongdecklandings.ThisisprobablybecauseWDLsarenotseenbypilotsasthemostsafetycriticalissue,andalsotheanticipationofawrongdecklandingisacomplexprocess.Pre-flightbriefingsare the idealplace for crews tonotewhereparticularWDLthreatsexist,anddiscussthem.AprocesscouldputinplacetosupportthepredictionandavoidanceofWDLsbyrecognisingwhenoneormoredecoyplatforms/vesselsrepresentahighthreat.Training or information dissemination for threat management around WDLswouldbeagoodstartingpoint,basedonfindingswithinthiswork.Butinfuturethis couldbe supportedautomaticallyby software linked to the flightplan.An

75

algorithmcouldbyprogrammedtoproduceacoefficientofriskforeachdeckintheroute.Thecoefficientwouldbeloadedbyfactorssuchas:• DecoyProximity• Decoyalignmentwithwindiflessthanthreemilesfromtarget,orontrack• Distancefromdeparturepointtodestinationminusdistancefromdeparture

pointtodecoy(ifdecoyisbeforeintendedtargetitismoreofarisk)• Visibility• Decoytypesimilarity• Namesimilarity• Frequencysimilarity• EvidencebaseButitwouldalsoincludeassessmentsfromagroupofpilotsaboutwherecertainknownthreatsare.Whencrewsreceivetheirroutepriortobriefing,theywouldseeariskfactorandhyperlinknexttoanyplatformscoringhighly.Theycouldsimplyclickonthis(asalink)andbepresentedwithinformationaboutthethreatincludingpicturesofallplatforms/vesselsinvolved.Thealgorithmanddatabasecouldbecontinuallyupdatedasexperienceisgainedandfedintoit.Recommendation8-Offset finalwaypoint(rating3or4,butneedstesting.SomerisksofWDLbyothermodes)IMPORTANT-Recommendation6and7arerecommendationsfordesigningandtestingtwogeneralproposalsandimplementingonlyiftrialsestablishthatthereisbenefitandthatnoadvertentconsequencesemerge.All non-ARA sectors should be flown to an offset point near the destinationplatform,butnever to thedestinationdirectly.Theoffsetwaypointwouldbeaset distance (e.g. 2 miles) left or right of track (the downwind side) andpreferably slightly ahead of the platform. This would have the followingadvantages:1. Since the waypoint is not visible, it could ONLY BE achieved through FMSnavigation(notbyflyingtoitvisually)andthereforethevisualtransitionerrorcouldnotapplyuntilacommondistancefinalturn,whereitismuchlesslikelytobean issue.Thecrewwouldhave far lessopportunity toselectadecoyatanypointinthesector,andwouldnotthereforeflyvisuallytothedecoy.2. Itwouldmean that every flight has a roll out from a final turn (even thoseapproaching straight in). This would allow reliable error trap placement (theerrortraphappensontherollout,andallsectorshavearoll-out.3. It would mean less manoeuvring in most flights, therefore limiting thepossibilityoflosingtheplatforminthemanoeuvre.

76

4.Itwouldavoidthenaturalcrewurgetochoosetheplatformonthenose,andreducetheopportunityandtemptationforearlyvisualselection.Additionally, formany flights, the sectordistance flownwouldbe very slightlylessthancurrently.Currentlyinmostcaseswhereacrewflyastraightlinetoaplatform, they end up having tomanoeuvre severalmiles away from it in anycase.Recommendation 9 - FMS route downlink (rating - only for the very smallpercentageoftype-2WDLs-3)WherecrewshavetomanuallytyperoutesintotheFMSfromthesource(paperor iPad)there isapotential forerrors intyping.Anautomaticdownlinkwouldsavetime,allowamorethoroughthreatanderrorassessment,andreduceerror.Recommendation10-Vesseldifferentiation(rating3)Clearly having two almost identical vessels in an areawill promotemost, andsometimesall,of theerrorsrequired forWDLs.Knowledgeof thedecoyvesselwillhelpconsiderably,andallowacrewtomanagethepotentialerrorbyusingradaretcwithawarenessofthedecoy.Alateerrortrapusingtheradiooperatorwill alsohelp, as recommended in this report.However considerationmustbegiventodifferentiatingverysimilar lookingandpaintedvessels,orat leastnotactivelytryingtomakethemlookidenticalandhavealmostthesamename(i.e.for branding purposes). Consideration should be given by operators of almostidentical vessels, to differentiating them by name and sight. The illustrationsbelowarefromarecentcompanyworkgroupfindingsdocument,andshowtwoalmostidenticalvesselswiththenames“Siemdaya1”and“Siemdaya2”.

Figure5.1–similarlookingvessels

77

5.3RecommendationsfornoticingandtrappingtheerrorRecommendation11–FMSsoftwarechange(rating–4)FMS software should be developed requiring the crew to allocate routewaypointswith‘destinationstatus’wherethosewaypointsareintendedlandingsites for theplannedroute.Suchstatus shoulddifferentiate thewaypoint fromothersandonlyshowtherouteassoliduntilthatwaypoint(orpreferablyshowno route beyond that waypoint in normal navigational modes). The waypointshouldalsoremainuntillanding.Ifpossibletheweightonwheelsswitchshouldbeusedtoscrolltheflightplanontothenextdestinationwaypoint.The FMS would extend a 2-mile dotted white line downwind of the landingwaypoint(platform)ifthewindisover5knots.Thiswouldofferagreatdealofsituational awareness support to the pilots as they manoeuvre onto the finalapproachpath.

Doing this would solve several issues causing WDLs, lower pilot workload(henceenhancingsafetyinotherareasofthetask)andallowthedevelopmentofamorereliablecrewcrosscheckoftheFMSonapproach.Recommendation 12 – Early final approach error trap (rating 2- 3 or even 4,dependingupondesignandimplementation)Since stabilised approaches are mandatory, the opportunity for a commonlyplacederrortrapisavailable.Thetrapshouldbeasearlyaspossiblewhilebeingabletoincludeallsectors(includingshuttles).Itshouldalsoinvolvebothpilots,beextremelyeasytoachieve,andtakeverylittletime.The essence of such a check would be to take the furthest common straightapproach distance that all flights will pass through. In other words take theshortestpossiblefinalapproachtrackthatanaircraftwilltake,andputthecheckatthatpointforallaircraft.Alternativelythepointcouldbetherolloutontofinalapproach.Thiswouldbestronger as a cue. However the disadvantages are that approaches will bedifferent lengthsandsomewillbe straight-inandnot involvea final turn.Onewaytodealwiththiswouldbeforaircraftnottoeverflydirectlytoaplatform–seerecommendation8.Whicheverpoint ischosenby theoperator, thecheckwouldbesimple.ThePFcalls“intendedplatform”thePNFstatestheplatformIDthatisintended.ThePFthenstates“FMSplatform”andthePNFlooksatthescreenandcallsthenameofthenearestplatforminthe12o’clockpositionontheFMS.ThePFthencalls“IDcomplete”ifthetwomatch.

78

AshapecouldbedrawnpermanentlyontheNavscreentoassist(intheabsenceof a software intervention). For example it couldbe an elongated redoutlinedoval (very thin lined) such as in Figure 5.2 below. The ovalwould be vertical,extending from a centimetre above the aircraft symbol to near the top of thescreen.Itwouldbeabout3cmswide.Equally,twodiverginglineswouldbeideal.With such a symbol the PNF need only look at the NAV screen and call thenearest platformnamewithin the shape. Thiswould help direct attention andlowerworkload,andbuildthecheckintotheculture.Anexampleisbelow.

Figure5.2

Recommendation13–LateapproachVisualErrorTrap(rating3ifcombinedwithsignagerecommendation)A late error trap that locks the helicopterwith the platform is desirable. Thisshouldbeatalatepointintheapproachbutwithsufficienttimeandspaceforacomfortablemissedapproachtobeinitiatedandflownifanerroristrapped.Ideally,thisshouldbecompletedbyaradiocallbetweenthecrewandapersonthedeck,notbyavisual confirmation. However it is recognised thaton someplatformstherewillnotbeapersonavailableandsothecrewmustperformthischeckthemselves.If the sign is placed very close to the helideck and in easy clear view (as inrecommendation19-‘signage’)thenthePFwillhavelittleproblemreadingthelettersandnumberson it,evenif theydonotprocessthe informationormakeanycomparisons. Indeedthis isanidealsituation.ThePNFcannotseethesignandsomustmaketheindependentcomparisonwiththeexpectedsituation,from

79

whatthePFreads.ThisoffersamorereliablecrosscheckoftheplatformIDthanthecurrentsystem.Itisthereforerecommended(onlyifsignagelocationischangedasdescribedinrecommendationsforsignage)thatastheplatformisapproachedtheprocedureisthatthePFreadstheIDplateonthehelideckedge,andthePNFthenreadstheexpecteddeck ID from theprocedure. It isup to thePNF to identify if there isdifference between the two IDs that were vocalised (this recognition will bealmostautomatic)andalso thePFcancall if theynoticeadifference.ThePNFshouldnotstatetheexpecteddeckIDintheapproachbeforethePFhasreaditfromthesign.IMPORTANT-Withthecurrentsignagesituationasafetyissueexistsifpilotsaresimplytoldtopaymoreattentiontosignageduringlatefinalsbecausecontrolofthehelicoptercouldbeimpededduetovisualsearchingawayfromtheprimarycontrolreference.Occasionallythiscouldtriggeranincidentorevenanaccident.Hence the late error trapping using signs should only be implemented if thesignageisputintosafepositionsfirst.Recommendation14(HLOerrortrap,particularlyvessels)(rating–4)Vesselsaremorevulnerablethanafixedplatformformanyreasons.Howeverona vessel, there is always a person available.Hence it is recommended that forvesselsasystemissetupbetweenthepersonandthehelicopter.Onesuggestionwouldbethatcontactismadefirst,thenatthecommencementofthe1milefinalapproach the helicopter crew call ‘aircraft-callsign direct inbound’. Onlywhenthe vessel crewmember sees a helicopter approaching on a final approachdotheystate“vessel-namevisual”. If thehelicopterdoesnothear thiscallbyasetdistance(e.g.0.3miles)thentheyperformamissedapproach.Thiswouldalsobeveryeffectiveonplatforms,butislabourintensive.HoweverWDLsontomovingvessels are a particularly difficult problem to resolve, and many of the otherrecommendationsinthisreportcannotbeapplied.Recommendation15–Alwaysuseradarreturn(rating–1)The radar should be interrogatedwith theNav displaywhen approaching theplatform.Thiswouldhelptopreventasituationwherebyanunknowndecoywasselected by the crew, and they were unaware that the actual platform wasnearbybutunnoticed.Theradarcouldalsoformpartofthecheckinafinalturn.Recommendation16–reducingconformationalstrategies(rating1-2)Crewsshouldbemade familiarwith the risksof confirmational strategies, andthe normal human propensity to use them. Crews should practice findingunanticipated data from the visual scene and checkingwhether it ought to bethere,andwhetheritfitsanypotentialdecoys.

80

This could form part of a CRM training course, and would integrate with thetraining issue around early platform selection. Crews should learn that thepropensity to accept the errorbecomesweakerover timedue to confirmationbias, and requires clear contrary cues to break it down. For this reason earlyvisualplatformselectionshouldbediscouraged,becauseclearsignsoferrorwilltakelongertoemergepost-selection.Recommendation17–reducemultipleplatformIDs(rating2-3)Inthepresentsystem,itiswellknownthattherearemultipleidentifiersforthesame platform, and crewswill use a number of these (ICAO identifier,marineidentifier,FMSidentifier,etc.).Thismaybenecessaryinmanyrespectsbutitisavery large general catalyst that drivesmanyWDLs indirectly.Where possible,consideration should be given to how all IDs could be made to relate to thehelipad.Aworldwidestandardnamingconventionwouldhelp (as identified intheIOGPreport).Recommendation 18 – clearance lights (rating 3 or 4 BUT only for the tinyproportionofveryhighconsequenceWDLs)This isa futureconsideration,but requiresconsideration (riskassessmentandtriallingwork).ToavoidthehighestconsequenceWDLs(thosethatwouldcausedanger,suchasiftheplatformwasventinggas)asimpleclearancelightorringoflightsonthehelideckwouldbebeneficial,tobeswitchedonwheneverahelideckwassafetoland.Ifnotseen,theapproachisbrokenoffandthesituationcanbeprogressedfrom that point. A red light (or similar) could strengthen this. Although thesystemwillpreventmosthighriskWLDsitwillnotpreventallWDLs.There are a number of considerations for such a system and a considerableamountofworkandriskassessmentwouldberequiredpriortoimplementation.ThefollowingisalsostatedinaprevioussectioninresponsetothissuggestionontheIOGPreview.Considerationshouldbegiventoissuesoffail-safe,andissuesarounddiversions.Another important consideration is that a crew seeing green lightswill factorthisheavilyasconfirmationthattheplatformtheycanseeisthecorrectoneforthem.Hence, if other platforms (specifically the decoy / decoys) also have thelightson, itmightmakeacrewmore likely tomis-select thatplatformas theirintended target. Although the subsequent WDL will be onto a ‘safe’ platform,thereareseriousriskconsiderations.Forexampleifgreenlightswerevisibleatadistance, andwas on because another helicopterwas using the platform thenlightingsystemcouldcreateagreater riskofmid-air collision,orat least crewdistractionandconfusionthatcouldleadtoaproblem.Theserisksmustbefullyconsidered. Hence, there are questions to be asked about how long the lights

81

remainon,whentheycomeonandwhattheymean(canahelicopterdivertontoaredlightplatforminanemergency?).Ifredlightplatformsaretobeavoidedatall costs, then the crew and planners need prior knowledge of this in case ofdiversions.AdecklightingsystemofthissortwouldnotstopthemajorityofWDLsitwouldonlypreventtherarestWDLsthatwereofthehighestconsequence.Thebottomlineisthatthesystemwouldalmostcertainlybeeffective,butwouldneedalotofworkbeforeimplementing.

82

5.4 Recommendations for signage (rating4, if donewell and thoroughlyandcombinedwithlateerrortraprecommendation)Signageisextremelyimportantforthefinalerrortrappingprocess.Presentlythesignageisonlyvisibleonlatefinalapproachwhenthepilotismanuallyhandlingusing the outside deck references to control the flight path. The location ofsignageisnoteasilypredictableforpilots,andsignsaresometimesnotvisibleormissing. All of this means that pilots cannot easily find and read the signswithoutattentionalshiftsthatinterferewiththemanualflyingprocess.Becauseofthis,anyattempttodirectpilotvisualattentionawayfromthehandlingtaskinordertopreventWDLswithoutoverhaulingthesignagesystemwouldpresentasafetyrisk.Recommendation19(rating3,ifcombinedwitheffectivelateerrortrap)Signsshouldbe

• Positionedontheedgeofthehelipad(soastobeclosetotheflying-pilot’smainvisualreference)asinFigure5.1.Thereshouldbeasignoneachsideof thehelipad thatanapproachcanbemade from,andthepositionandplacementshouldbeconsistentacrossplatforms.

Figure5.1-Proposedsignpositionandformat

83

• IncludeonlythedeckIDusedbycrews(noprefixandsuffixe.g.“-DP”)

• Aslargeaspossible

• Highly visible, very clear, andwellmaintained. They should also beconsistentincolour.

• Identifiable as helipad ID names by the use of a surround (e.g. a

hexagon) that also bounds the key figures if others are included. Ifprefixesandsuffixesareinsistedupon,themaindecknameshouldbeboundedby theshape.Thiswill lead to fasterrecognition(makingawrongplatformIDeasiertodetect)butalsomeanthatthepilotdoesnothavetoperceivethecodeorlettersfirstinordertoknowwhetherthey are the deck ID (i.e. to make searching for the deck IDeasier/quicker and alleviate theneed to confirm that code is indeedthe deck ID). In otherwords the pilot knows thatwhat he or she isreadingisthedeckIDbecauseitisinsideaHexagonwhichmeansthatany words or codes that are not enclosed by a hexagon can bediscarded without reading them or working out weather they areimportant. Along with consistency of placement location, this willmakealateerrortrapontheplatformIDrealistic.SeeFigure5.1.

84

PART6-COMMENTSONPREVIOUSRECOMMENDATIONS

85

CommentsonpreviousrecommendationsThis section looks at previous recommendations for reducingWDLs from tworeports. Some of the comments are opinion of the author, because therecommendations could not be informed by anywork done. An early decisionwasmadenot tobe influencedbypreviousrecommendations,but toallowthedatacollectedtodrivetherecommendationsmadeinthisreport.Thetwosetsofpreviousrecommendationswerethenlookedat.In somecases,where clear recommendationsweremadepreviously thatweregood,theyhavenotbeenrepeatedintherecommendationsectionofthereport,unlesstherewasgoodreasontodoso.6.1HelioffshoreWDLworkinggroupdiscussiondocumentThe discussion document produced by the WDL working group proposes anumberofrecommendations,eachiscommenteduponhere.1 Impressuponcrewstheneedtoalwaysfollowthechecklists(rating<1).

ThisisworthdoingifdonesensitivelybutitwillnotreduceWDLnumbersnoticeablyifatall.Checklistusageintheairisalwayssubjecttoinfluencesofthedynamicsituation.Mostpilotsdonotconsciouslyomitchecklistsorconsciouslymake checklist errors. All pilots use checklists unconsciouslyon occasions, especiallywhen airborne (all pilots, despitewhat theywillsay) and so general training messages requesting better checklist usagewill have almost no effect even if the pilots accept them fully (unless anoperatorhas a currentproblemwith crewsnot following SOPS, inwhichcasethesolutionwouldbequitedifferent).ThisisalsoaverysmallpartoftheanswerinWDLs(ifatall).Ifapproachedwrongly,itmayhavetheoppositeeffect.Ariskisthatsomepilots could see such messages as ill-conceived (and so the message isundermined)orasanattackontheirprofessionalism.

2 Name the intended destination during briefings & radio calls, by bothhelicoptercrews&HLOsorR/Os.(Rating1to2,ifimplementedwell)Agree,butwithreservations.TheR/OorHLOshouldnamethedeck thattheyare ‘clearing’.Pilots shouldbrief thedeck in thedescentorbeforeashuttle take off. However if the deck name is used in all radio calls thiscouldleadtopilotsreducingattentiononit.Hearingandsayingitsooftencouldleadtopilotssimplysoundingouttherightdeckname,regardlessofwhat they see on theNav display or deck ID. I.e. the deck ID becomes asoundthatcanbemadeunconsciouslywithoutevenbringingupanimageofthefigures,wordorplatform.

86

3 Improve the sizing and visibility of vessel identification and helideckmarkings(rating3)Fullyagree,andshouldgofurther.Sizeandvisibilityisonlyonepartofthisproblem in termsof identifying theplatform from its signage. See reportconclusionsfortheotherfactors(commonality,position,bounding,etc.).

4 Requirecrews touseFMS/NAVoverlayon theradar screenwhenavailable(rating1).Agreethatthiswouldresolvesomewrongdecklandings,butthedetailandpracticalityisimportant.Theword‘use’oughttomeanswitchitonandpayattentiontotheoverlay.Howeverthisisageneralinstruction,notaspecificcheck, and it will take voluntary crew attention but usually provideinformationthatisnoextrausetothecrew(becausethecorrectdeckhasalreadybeenidentified).Crewsthereforemaynotadheretothis,particularin seemingly easy shuttling tasks.However itwould certainlyhelp in thecasewhereadecoyplatformexistsandisnotknowntothecrew.Again,seerecommendationssections.

5 Reducethenumberoflastminuteroutechanges(rating2).This is desirable andwill sometimesprevent the issue of task saturationandmaypreventaWDL.

6 When routing to highly mobile vessels, crews gather position & weatherinformationthemselvesduringtheplanningphase(rating1).This isworthdoing if theoutcomeof the crewanalysis of information istriangulated to avoid errors andmistakes caused, for example, by crewsrushingduetobeinglateorhavingotherissuestakingtheirtime.Bydoingthe work themselves, crews are more likely to remember more of theinformationandhavebetterpreparedsituationalawareness.

7 Reduceradiochatter(rating<1forWDLsspecifically).

A few WDLs appear to involve excessive radio chatter, so any reductionwouldbehelpfulinmanyrespects,notjustwrongdecklandings.Howevercompared to other causal factors, the issue is not seen as a priority forresolvingtheissueofwrongdecklandings.

87

6.2IOGPWOHLdocumentThe IOGP WOHL document (Jan 2015) proposes many recommendations.Commentsaregivenhere.PF-1: Standardized scheduling scheme with mandatory “stop the clock” for anychanges.Minimizing flightdetail changes.Nochangeswithin60minutesofETD.(Rating1to2dependinguponwhatisdone).Byitself,thiswouldbeunlikelytomakeanydifferenceinpreventingWLDsdueto the way that the majority occur. However it would facilitate and assist arevised pre-flight process (such as recommendation 5 or 7 in this report)wherebycrewsidentifyand/orprepareforapotentialWDLaspartof thepre-flight process. However it will not assist in themajority of cases, but is goodpracticeifitcanbeachievedandwillresolveotherissuesthatcrewsfaceaswellaspossibleassistancewithWDLpreparation.Ifitpreventsin-flightchangesthenit is likely tobeeffective inpreventing someWDLs.Additionally, if itpreventslastminutechangesthatimpactuponTEMthenitwillalsobemoreeffective.PF-2:ConsideravoidanceofprovidingroutedetailstooearlytocrewToavoidlowengagementthresholdintheplanningprocess(rating<1)This would require trialling, since nothing in this work informed this idea.Howeverintheopinionofthisauthor,suchapolicywouldnotgiveanetbenefitintacklingWDLs.PF-3: Standardization of the manifest & routing information (rating 1 incombinationwithotherrecommendations,andrating2forthe20minuteupdatingofpositions).This suggestionwould be useful as part of the overall contributory factors toWDLs, by supporting other interventions such as better TEM around WDLthreats.ThisideawillprovideindirectsupportforotherWDLinitiatives,butnotpreventWDLs itself.The20minuteupdatingofpositions frommovingvesselsshouldcertainlybeconsidered,asthiswillhelp.PF-4:Pre-flight(TEM)crewbriefing(rating–seerecommendations5,6and7inthisreport)FromaWDLperspective,thiswillhelp.It isdiscusseddifferentlyaspartoftherecommendationsinthisreport(particularlyrecommendation5,6and7),sothereaderisreferredtothosesections.PF-5:Properdocumentation (rating–unsureof the scopeof theproblemwithinwiderindustry,Probably1).

88

This will assist in preventing WDLs. Elements of this align with a numberrecommendationsinthereport.FE-1:Enteringandcross-checkingof the route (inFMS)prior todeparture i.a.w.providedroutinginformation(rating1fortype2WDLsonly).RouteerrorscontributetoaminorityofWDLs,andsothiswillnotresolvemorethanafewWDLs,butanyfocusoncorrectroutesenteringtheFMSwillwork.Seereportrecommendation8.FE-2:Route verification (in FMS& visual clues) prior to eachdeparture. (RatingPotentially1dependingontheimplementationanddetail).Manycrewsalreadyperformaquickprocesspriortoleavingaplatform,onsomeormostoccasions.Theeffectivenessofsuchapolicywouldbeinthedetailofit.Most departures occur from platforms and with passengers aboard. Theenvironmentisusuallydynamicandthepilotstrynottospendanyextratimeonthe deck that is perceived as unnecessary. That does notmean they rush, buttheytrynot tocreatedelays.Havingageneralpolicy forpilots tocheckthisaspartofachecklistitem(e.g.“brieffornextplatform”)couldhaveverylittleeffect,because theprocesswillbe interpretedadifferentwaybydifferentpilots,andwill be short-cut on most occasions, and not usually seen as relevant ornecessary. Stipulating the process will have some temporary benefits but willleadtopilotspayinglipservicetoitonmany,ifnotmost,occasions.Theprocesswould need to be very simple and formalised, containing a fewdiscrete checkpointsonly,asopposedtorequiringare-briefofdestinations.OnecheckcouldbeforapilottolookattheFMStoseethedestinationandaskapreparedopenquestion to theircolleaguesuchas “nextdestination?”Whetherthecolleague looksattheFMStoanswer is irrelevant,buttheyshouldanswer.This would bring both pilots into the loop. This is not repeated in therecommendationssection.DoingthiswouldhavesomeeffectonWDLscausedbycrewsmis-sequencingfromtheroute(seefaulttree),butthesearecurrentlyinaminority.FE-3:Communication(rating–unabletogiverating)This is too general to comment on. Clearly communication is important, but abalanceisrequiredinordertoreduceradioclutter.FE-4:BetterusageofFMScapabilitiestoimprovesituationalawareness.Rating<1withcurrentFMSThiswouldwork inan idealworld,but is thewrongthingtodocurrently.Theflaw here is that the crew would have to action this on every sector. Theinformation it would providewould be of great benefit when aWDL is beingtriggered,andwouldthereforepreventWDLs.Howeveritwillnotdosobecause

89

itwillnotbeusedbycrewsinreality,orwillbeshort-cut.Thereasonisthataddsconscious work for the pilots (particularly over a multi sector trip) that onalmostalloccasions isnotrequiredatall,andevenworse,onoccasionscanbeseen to be not requiredwhile it is being done. This goes against theway thathumansoperate,andwillbedroppedbypilotsveryquickly.Forthisreason,ifitwas implemented itwill result in routineviolationsof thepolicy,and increwsnotfollowingitonmostoccasions.Thereforeitwillhavelittlepositiveeffect,andyet it will create frustration and normalised violations in crews, which isunhelpfultosafetyandrelations.ThecurrentreportdetailshowtheFMScouldbeupdatedtoprovidethiskindofsituationeverytimewithoutcrewhavingtoprogramit.Thiswouldofferalltheadvantages on a permanent bases, and would be appreciated by crews. Seerecommendation11.FE-5:ApproachBriefing(rating<1)CareshouldbetakenwiththisideabecauseinFlightbriefingshavethepotentialto distract crews frommore important considerations.Hence even if it helpedreduce WDLs it could cause other incidents. Given the way that WDLs aregenerated,anapproachbriefingwouldonlybeusefulbeforetargetselection.Itisunlikelythatanapproachbriefingwouldtrapamis-selectionerrorthathasbeenmade already, and certainly not better than a designed error trap could (seethoseinthereportsection5.3).Onmanyoccasionssuchabriefingwouldsimplygetinthewayofthetaskandbeofnouse,andthereforeitrisksbeingdropped,short-cutorforgottenbycrewsunlessitismadeextremelysimpleandaspartofaformalsetofchecks.In the author’s opinion, this would not be effective against WDLs, and couldcauseotherissues.SF-1: Available references – proper implementation in the checklists (ratingunable).It is difficult to comment on this since there is little information about how itwouldbeactioned.Clearlyhavingtherightinformationavailablecannotdoanyharmandmayhelp.SF-2:Visualrecceforconfirmation–ratingimpractical(<1)Intheonlinesurvey,thiswaspopularasareasongivenastowhyWDLshappen(inhindsight), i.e. thecrewdidnot flyover theconfirm.Noobservation flightswere observed in which the crew performed a recce or flyover in order toconfirmtheplatformname.Clearly theproblemhere is thatunless this ispartof amissedapproach/ go-aroundthenitmeansthatthecrewwillhavetodoitveryregularly,becausefinal

90

identificationofavesselorplatformisproblematicbefore1mile.Operationally,this is probably unacceptable and will also introduce more risks due to themanoeuvring low down while looking over at a platform, as well as furtheropportunity for a WDL (because a new manoeuvre would be flown and thewrongdeckcouldbepickedup).So whereas in hindsight, such a process seems obvious to have performed, acrewwhodonotknowthat theyareabout to landon thewrongdeckwillnotknowthata flyoverwillbeofbenefit. It isclearly impractical forallsectorstoinvolvearecce/flyover‘justincase’,orevenforalloccasionswhentheplatformisindoubt.Asaferandmorereliableoptionwouldbetosaythat if indoubtby late finals,thenflyapropermissedapproach.(Note-Thisisnotarecommendationbythisreport)SF-3:Deckclearance(ratingpotential4)Seerecommendation14insection5.3(HLOerrortrap,particularlyvessels)SF-4:Take-offbrief&routeverificationondeckduringshuttleoperationsThiswas considered the sameas recommendationFE-2 (Routeverification (inFMS&visualclues)priortoeachdeparture),andsothereaderisreferredbacktotheresponsetothatrecommendation(above).OI-1:Switchablegreen-redhelideck lightingto indicate thestatusof thehelideck(greeniscleartoland,redisnolandingapproved).Potentially3or4forhigh-riskevents).Lightingsystemsofthiskindwouldclearlybeofbenefit, ifsetupandoperatedtherightway.Thatisnotagiven,andtherightwayisnotknownandwouldneedtesting.The colours of the lights need to be considered. Consideration should also begivento issuesof fail-safe,andissuesarounddiversions.Additionally,althoughthesystemwillpreventmosthighriskWLDsitwillnotpreventallWDLsunlessplatforms switch to green lights for a very short time during the helicopter’sarrivalonly.Another important consideration here is that a crew seeing green lights willfactor itasconfirmation that theselectedplatform is thecorrectone.Hence, ifother platforms (specifically the decoy / decoys) also have green lights on, acrew are more likely to mis-select that platform as their intended target.Although the subsequent WDL will be onto a ‘safe’ platform, there are riskconsiderations.

91

Hence, there are questions to be asked about how long the lights remain on,whentheycomeonandwhattheymean(i.einanemergencydiversion).OI-2: Status lights to indicate only a hazardous condition (gas leak) on theinstallation(ratingpotentially4forhighconsequenceWDLsonly).ThiswouldbesimpleandveryeffectiveforpreventinghighconsequenceWDLsonly.Clearlytheredlightwouldneedtohavefailsafeconsideration.Thestrengthof the systemwould be held by the red light usage beingminimised to highlycriticaltimesonly.Itshouldnotdrifttowardsasystemwhereplatformsswitchon red lightswhenever a landing aircraftwouldbe inconvenient, orwhenevertheyarenotexpectingone,unlesstestsprovethatthisisworkable.OI-3:Similarityof(field)sisterrigs/ships/mobiles(rating–seereport)This issue has already been covered and can be read in a number of reportrecommendations.OI-5:Presence/clarityofnameoftheinstallation(rating2)Thisisveryimportantforerrortrappingandisfullycoveredinrecommendationsection5.3OT-1:Familiaritywithwronginfoscenario(rating–1)This is worth doing, and should feed into TEM training. It will not solve themajorityofissueswithWDLsanditseffectivenesswillalsoreducewithtime,likeanytraining.Seerecommendation4inthisreport.OT-2:Installationnamingconvention(ratingpotential2–3)This is a key issue that will continue to promote WDLs despite all otherinterventions,andsodoesrequireresolution.Initselfitdoesnotdirectlycausemany WDLs, but it has the potential to cause errors throughout the WDLlandscape.Seerecommendation17ofthisreport.OT-3: Simulator training (0 to 2, but it depends on the detail andwhat is to betrained.Inmanycasestheratingis<1)This is might be worth trying as it would be easy to implement into LOFTtraining scenarios. However in the author’s opinion it would make littledifference to the WDL issue for many reasons including the capability of thesimulatortoproducerealisticplatformsituationsandthepsychologicalvalidity(i.e.crewsarenotintheirnormalsocialenvironment).

92

However theopportunitywould exist tohelp crewspracticenon-confirmatorystrategies and resist social effects that confirm theplatform to eachother. Seesection2.1.4and2.1.5andrecommendation4(section5.2).OT-4:RadioOperatorandHLOtraining(rating1-2potential)This would improve many areas and help several other recommendations.However unless specific training is focussed on these issues discussed andinterventions being made, then the WDL situation would remain mostlyunchanged.OT-5:Routes(ratingpotentially2incombinationwithotherrecommendations)AlltherecommendationsunderOT-5aresensibleandwouldhelptomitigatethesituationwherebythePNFbecomesoverloadedandthehelicopterturns intoasingle crew operation which promotes selection and confirmation errors, andhenceWDLs.However although these changes will definitely be helpful, they will notmarkedlychangetheWDLlandscapedirectly.Clearlytheymightprovedifficulttoimplement.Sofromacost-benefitanalysisthesemaybealowpriority(ifthe‘cost’isveryhigh).OT-6: Varying appreciation of WDL and its consequences (rating 1 – 2 incombinationwithotherrecommendationsonly.Byitselfthiswillhavelittleeffect).Buy-infromallareasoftheindustryisclearlyanimportantfoundationwhateverrecommendationsaremade. If it isconsideredthat theOT-6recommendationswillimprovevisibilityandbuyinatthetime(orjustbefore)implementationofnewprocesses,thisisaverygoodidea.Howevertheremaybelittlebenefitindoingthisunlessotherprocessesaroundsolvingtheproblemaremoving,becauseanyinitialenthusiasmmaybewastedifnothingisbeingseentohappen,andwillmoveawaytootherconcerns.

93

APPENDICES

94

Appendix1 Pilotactions,performanceandhumanfactors(183)18 Complacency(theword)1 Laziness1 Unprofessionalism2 Over-confidence10 LackofAttention/vigilance2 shortcuts/lesscheckingduegoodweather/viz.7 Distraction4 Non-sterilecockpitonapproach3 Stress11 Fatigue16 Workloadorextratasksinfinalapproach8 Expectancy-seesrigtheyexpecttosee5 Rushing,hurrying5 PoorcrewCommunicationand/orCRM2 Taskprioritisationissues2 Confusionduetoinformationsources1 Workloadcausedbypaperworkinflight1 Customerchangescausingcrewconfusion5 Unfamiliarityofcrew1 Confirmationbias1 Pilotsfulfillingperceivedexpectationofperfection3 Pressuretocompletemission2 commit/IDplatformbeforefinalapproach1 Poortraining1 Lackofarousal1 HumanError1 Usingfewinformationsources-Notcross-checkingotherinfo/equipment2 PoorPre-flightpreparation7 Low/poorSA9 Notfollowingprocedures(general)7 Notfollowingchecklist13 Failuretocheck/readnameonfinals10 Notpositivelyidentifyingplatform/installation1 Breakingsequenceofchecklistorprocedure1 NotusingNDB6 Notoverflydeck-Straightlanding1 Checklistlip-service8 SelectwrongpositionorcoordinatesinFMS1 NotfollowingFMSon/duringfinalapproach1 SelectwrongriginFMS-similarname1 Losingrigoncurvedapproachpattern

95

Signage/lighting(39)16 Signagepoor(generalcomment)3 Signageinconsistent/non-standardisedornotcorresponding4 Signagedifficulttoread8 Signagemissing,notvisibleorhardtofind6 Signstoosmall1 Signageormarkingsincorrect1 DeckLightingnonstandard Rigcharacteristics(37)13 Nearbyrigslooksimilar2 Similarlookingboats/vessels3 Decksclose/clusteredandsimilarappearance4 Appearancenotdistinguishable/lackofcues6 Similarplatformnames2 Installationsinline6 Alotofrigsinarea1 Samebeaconfrequencyfordifferentinstallations Operationalandgeneralconditions(25)4 Shuttleflights/multiplelandings1 Landingtominimafromradarapproach5 Othertraffic12 BadWeather/vis.Etc.2 Goodweather1 night FMS/Navissue(19)11 Rigpositioninformationwrong(eg.databasenotuptodate,moved,etc.)1 PoorFMSdisplay5 Imprecisenon-updatedpositionreportsfrommovingvessels2 Coordinateschangesasvesselmoves Helipadcomms(8)3 HelideckCommunicationpoorordifficult3 Clearedtolandtooearly-notyetvisual1 ClearedtolandprocesscausesWDLs1 Crewsgivenwronginformation

96

ProceduresandChecklistsareineffective(3)1 Proceduresorchecklistspoor1 Checkliststoolongorcomplex1 Checklistchanges Visualrestriction(2)2 Restrictedvisionofonepilot,meaningcannotreadlabeluntiltoolate

97

Appendix2

No ofcommentsgiven foractualevents(anecdotes)

No ofcommentsoffered infirstquestion

Complacency(theword) 4 18Laziness 0 1Unprofessionalism 0 1Over-confidence 0 2LackofAttention/vigilance 2 10shortcuts/lesscheckingduegoodweather/viz 0 2Distraction 2 7Non-sterilecockpitonapproach 0 4Stress 0 3Fatigue 2 11Workloadorextratasksinfinalapproach 0 16Expectancy-seesrigtheyexpecttosee 0 8Rushing,hurrying 0 5PoorcrewCommunicationand/orCRM 2 5Taskprioritisationissues 0 2Confusionduetoinformationsources 0 2Workloadcausedbypaperworkinflight 0 1Customerchangescausingcrewconfusion 1 1Unfamiliarityofcrew 5 5Confirmationbias 0 1Pilotsfulfillingperceivedexpectationofperfection 1 1Pressuretocompletemission 1 3commit/IDplatformbeforefinalapproach 0 2Poortraining 0 1Lackofarousal 0 1HumanError 1 1Usingtoofewinformationsources 0 1PoorPre-flightpreparation 1 2Low/poorSA 1 7selectwrongpositionorcoordinatesinFMS 0 8NotfollowingFMSon/duringfinalapproach 2 1selectwrongriginFMS-similarname 0 1Losingrigoncurvedapproachpattern 0 1Notfollowingprocedures(general) 0 9Notfollowingchecklist 2 7Failuretocheck/readnameonfinals 0 13Notpositivelyidentifyingplatform/installation 2 10Breakingsequenceofchecklistorprocedure 0 1

98

NotusingNDB 0 1Notoverflydeck-Straightlanding 0 6Checklistlip-service 0 1Signagepoor(generalcomment) 1 16Signageinconsistent/non-standardisedornotcorresponding 0 3Signagedifficulttoread 0 4Signagemissing,notvisibleorhardtofind 1 8Signstoosmall 1 6Signageormarkingsincorrect 0 1DeckLightingnonstandard 0 1Nearbyrigslooksimilar 15 13Similarlookingboats/vessels 13 2Decksclose/clusteredandsimilarappearance 0 3Appearancenotdistinguishable/lackofcues 0 4Similarplatformnames 4 6Installations/vesselsinline 6 2Alotofrigsinarea 5 6Samebeaconfrequencyfordifferentinstallations 0 1Shuttleflights/multiplelandings 9 4Landingtominimafromradarapproach 0

Othertraffic 1 5BadWeather/vis.Etc. 7 12Goodweather 5 2night 1 1Rigpositioninformationwrong(e.g.notuptodate,moved,) 3 11PoorFMSdisplay 0 1Imprecisenon-updatedpositionreportsfrommovingvessels 2 5Coordinateschangesasvesselmoves 0 2HelideckCommunicationpoorordifficult 1 3Clearedtolandtooearly-notyetvisual 0 3ClearedtolandprocesscausesWDLs 0 1Crewsgivenwronginformation 4 1Proceduresorchecklistspoor 0 1Checkliststoolongorcomplex 0 1Checklistchanges 0 1Restrictedvisionofonepilot-cannotreadlabeluntiltoolate 0 2Rigobscuredbycockpitstructure 1

Rigobscuredbehindotherrig 2Forgottogetdeckclearance 1Anotherrigorvesselneartotarget 27IMC/VMCintermittent 2PreventedbyHLOs 1

99

Appendix3-InFlightObservationsThe followingprotocolwasused to assist observations.Not all questionswereansweredonallsectors,andotherobservationsweremade.FMSprogramming/checking

1. DoesthePNFprogrammetheentirerouteintotheFMSbeforeliftingattheCompanyBase?

2. Anyprogrammingdeferreduntilthecruise?Ifso,doesthePFcheckthis?

3. Anychange/re-planofrouteafterdeparturefromBase?Ifso,arebothpilotsinvolved?

Ontheground/helideck

4. Whatbriefingsdothepilotsdorelatedtothenextwaypoint/deck?

5. Howmuchcommunicationisthererelatedtopossiblemisidentificationofplatform?What?

6. Anythreatanderrorbriefings?What?

Inflight

7. Does‘down-time’appearintheflights(i.e.lessformalitybetweenpilots)

8. DopilotsflythetrackasontheND,anduntilhowmanymilesapproximately?

9. Howmuchdothetwopilotscommunicateabouttheplatformidentification?

Spottingplatform

10. Whatsortofquestionsandcommunicationsdopilotsmakeaboutthedestinationwhiletryingtospotit?

11. Howfaroutdotheystarttryingtofindtheplatform?

12. Notethefirstcommunicationsofplatformidentification

13. Whatdoesthefirstpilottomakethespotdo?

14. Isitclearwhentheplatformhasbeenidentified…whatget’ssaid?Afterthis,isitchallenged?

15. Dopilotscontinuetoquestiontheidentification?

16. Dopilotskeeptheprocess‘open’afterinitialsighting?

17. Dopilotsuseopenquestionsaftersightingtheprobableplatform?

18. AtwhatpointdopilotsclosetheIDprocess(stopACTIVEquestioning)?

19. Doanyothercuesdrawtheirattention/getconfirmedafterthis?

20. Anyothernotesabouttheplatformspotting/confirming

NavDisplay

21. HowdopilotsusetheFMC(dotheysuspendwaypoints?Dotheyusethe‘directto’command?)

22. WhatscaledothepilotssettheirNDsastheygetnearertheplatform?

23. Whennearingtheplatform(e.g.5nmand2.5nm)isthereagapbetweenheli-symbolandplatformwaypoint?

24. Doesplatformwaypointdisappearpriortolanding?

25. Isthereaverbalcross-checkwithNDwhennearingtheplatform(orincircuit)?

FinalcircuitandApproach26. Howmuchcommunicationistherefrom5nmtoplatform(howmanychannels,whoisdoingwhat,howbusydoesitgetatworst?)–arethetwopilotsstillinreasonablecommunicationwitheachotheroraretheyfocusedonseparatecomms?27. Whenmanoeuvringontoapproach,whatisthesituationintermsofheadsupandheadsdown?

28. WhatisthemaxtimefrombeingabletoreadthedeckIDtoreachingthedecisionpoint?

29. WhatdoesthePNFdoonfinalapproachafterviewofdeckislost?(wherelook,whatsay?)

30. HowdoesthePNFdoadeckIDcheckonfinals??